Extent-based fibre channel zoning in hardware

ABSTRACT

The present invention provides a system and a method for filtering a plurality of frames sent between devices coupled to a fabric by Fiber Channel connections. Frames are reviewed against a set of individual frame filters. Each frame filter is associated with an action, and actions selected by filter matches are prioritized. Groups of devices are “zoned” together and frame filtering ensures that restrictions placed upon communications between devices within the same zone are enforced. Zone group filtering is also used to prevent devices not within the same zone from communicating. Zoning may also be used to create LUN-level and extent-level zones, protocol zones, and access control zones. In addition, individual frame filters may be created that reference selected portions of frame header or frame payload fields.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is related to U.S. patent application Ser. No.10/123,996 entitled “Fibre Channel Zoning by Device Name In Hardware” byDing-Long Wu, David C. Banks and Jieming Zhu filed Apr. 17, 2002; Ser.No. 10/124,499 entitled “Fibre Channel Zoning by Logical Unit Number inHardware” by Shunjia Yu, David C. Banks, Ding-Long Wu, and Jieming Zhufiled Apr. 17, 2002; Ser. No. 10/124,303 entitled “Frame Filtering ofFibre Channel Packets” by Jieming Zhu, Shunjia Yu, David C. Banks andDing-Long Wu filed Apr. 17, 2002 and Ser. No. 09/972,471, entitled“System and Method for Storing and Retrieving Multi-Speed Data StreamsWithin a Network Switch” by Kreg A. Martin and David C. Banks, filedOct. 6, 2001, which are hereby incorporated by reference.

BACKGROUND OF THE INVENTION

1. Field of Invention

The present invention relates generally to a system for monitoring andfiltering frames sent within a network system, and more particularly, toperforming actions upon frames based upon individual frame contents.

2. Description of the Related Art

As the result of continuous advances in technology, particularly in thearea of networking such as the Internet, there is an increasing demandfor communications bandwidth. For example, the transmission of data overa telephone company's trunk lines, the transmission of images or videoover the Internet, the transfer of large amounts of data as might berequired in transaction processing, or videoconferencing implementedover a public telephone network typically require the high speedtransmission of large amounts of data. Such applications create a needfor data centers to be able to quickly provide their servers with largeamounts of data from data storage. As such data transfer needs becomemore prevalent, the demand for high bandwidth and large capacity in datastorage will only increase.

Efficient data storage and management are becoming increasinglyimportant to business-critical decision-making. This data dependence hasgreatly increased the number of input and output transactions, or I/Os,required of computer storage systems and servers. As a result,organizations are being forced to dedicate substantial resources tomanaging and maintaining their storage systems.

Fibre Channel is a transmission protocol that is well-suited to meetthis increasing demand, and the Fibre Channel family of standards(developed by the American National Standards Institute (ANSI)) is oneexample of a standard which defines a high speed communicationsinterface for the transfer of large amounts of data via connectionsbetween a variety of hardware devices, including devices such aspersonal computers, workstations, mainframes, supercomputers, andstorage devices. Use of Fibre Channel is proliferating in manyapplications, particularly client/server applications that demand highbandwidth and low latency I/O. Examples of such applications includemass storage, medical and scientific imaging, multimedia communications,transaction processing, distributed computing and distributed databaseprocessing applications.

In one aspect of the Fibre Channel standard, the communication betweendevices is based on the use of a fabric. The fabric is typicallyconstructed from one or more Fibre Channel switches and each device (orgroup of devices, for example, in the case of loops) is coupled to thefabric. Devices coupled to the fabric are typically capable ofcommunicating with every other device coupled to the fabric.

Conventional Fibre Channel systems freely pass frames from a sourcedevice to a destination device without individualized frame filtering orreview. However, there are situations where the ability to freelycommunicate between all devices on a fabric is not desirable. Forexample, it may be desirable to screen off certain devices on a fabricin order to perform testing and/or maintenance activities on only thosedevices, without the risk of interfering with the other devices on thefabric. Devices may need to be segregated according to their operatingsystem or other technical features. Certain devices may wish to receiveonly frames using a certain protocol. Access to or by certain devicesmay need to be restricted for security reasons. Additionally, the systemmay wish to monitor the characteristics of individual frames being sentwithin the fabric.

Conventional Fibre Channel fabrics do not support the filtering ofindividual frames from the hardware level. Devices can be prevented fromcommunicating with each other typically only if they are actuallyphysically separated (e.g., coupled to different fabrics). However, thismethod does not facilitate the ability to examine each frame and makeindividualized decisions concerning the actions to take for each frame.

In certain fabrics, this segregation, or zoning, can be accomplished bysoftware present in the switches. An example of this operation isprovided in U.S. patent application Ser. No. 09/426,567, entitled“Method and System for Creating and Formatting Zones Within a FibreChannel System” by David Banks, Kumar Malavalli, David Ramsay, and TeowKha Sin, filed Oct. 22, 1999, which is hereby incorporated by reference.The Simple Name Server present in the switches may provide softwarezoning, providing only the information on devices that are in the zoneduring the log in processes of a device. However, software zoning islimited in that the entire fabric is still accessible to a “bad” devicewhich otherwise determines devices present on the fabric. Thus, whilesoftware zoning is available, it is not sufficiently secure, and somesort of hardware protection mechanism using frame filtering is stillneeded.

Certain switches, such as the Silkworm 2800, provided by BrocadeCommunications, Inc. have limited hardware zoning which is accomplishedby limited hardware frame filtering. This is also exemplified in U.S.patent application Ser. No. 09/426,567. When devices on a fabric areinitialized, they receive a Worldwide Name (WWN). A portion of this WWNincludes details on the domain and switch port to which they areconnected. Those certain switches have the capability of monitoring thesource and destination domain and port numbers of a packet and canperform zoning or filtering on that information. However, even thoughthis port hardware zoning is a security improvement on the softwarezoning, it is still very limiting and is inflexible. Additionally, it isnot as secure as desired, as any devices within the zone cancommunicate, so that the fabric must be organized so that devices do notcontain material that must be secure from any other devices in the zone.This limits the end user's capabilities for designing their computersystem, increasing costs and complexity.

In still other switches, such as the Silkworm 3200, 3800, and 12000 fromBrocade, frames are reviewed in hardware against a set of individualframe filters. Each frame filter is associated with an action, andactions selected by filter matches are prioritized. Additional actionsmay be defined if a frame does not generate a filter match. Filteringactions include, but are not limited to, forwarding the frame,discarding the frame, performing additional processing upon the frameand creating new frame filters based upon the frame contents.

One technical aspect of frame filtering enables groups of devices to be“zoned” together, for example by WWN. At the hardware level, framefiltering of zone groups (used interchangeably with zone groupfiltering) ensures that restrictions placed upon communications betweendevices within the same zone are enforced. Zone group filtering is alsoused to prevent devices not within the same zone from communicating.Zoning accomplished by frame filtering may be further expanded to createLUN-level zones, protocol zones, and access control zones. In addition,individual frame filters may be created that reference selected portionsof frame header or frame payload fields for zoning purposes.

Frame filtering is typically performed at or near wire speed. In orderto provide for a rapid frame decision-making process, much of the framefiltering process is performed by hardware structures, thereby providinghigher levels of security then conventional software zoning techniquesand more flexibility and security than just port-based hardware zoning.Additionally, frame filtering in accordance with the present inventioncan be expanded beyond the limits of the physical hardware structuresthrough the use of virtual frame filtering structures, thereby callingupon the kernel software layer to enable this feature.

While LUN zoning provides better zoning then prior methods, even thatzoning level has potential security problems. In many cases each LUNincludes a number of partitions or volumes. This is usually done tosimplify management of the storage but can also be done to restrictrights in particular partitions. Therefore in many cases it is notdesirable to allow a particular host to have access to the entire LUN,but only selected partitions. Thus, it would be desirable for a givensituation to be able to further limit a LUN zone to a partition orpartitions within a particular LUN. But the prior LUN zoning does notallow this further granularity. Thus it is desirable to provide zoningto within a partition or partitions of a LUN to further improvesecurity.

BRIEF SUMMARY OF THE INVENTION

Systems according to the present invention provide extent- orregion-based zoning to allow even greater security. This extent zoningis an extension of the LUN zoning previously performed in hardware andallows zoning to the partition level or below. The extent hardwareexamines the payload of the frame to determine the particular sectors orextents in the storage device LUN to be accessed for that particularframe. The extents in a particular zone can be a single sector range orcan include multiple sector ranges. In the case of multiple sectorranges, a fixed limit to the number can be defined or a link list can beused for greater flexibility.

Therefore, techniques according to the present invention further improvezoning by taking it to the level of extents within LUNs, thus providingfurther security.

The features and advantages described in the specification are notall-inclusive, and particularly, many additional features and advantageswill be apparent to one of ordinary skill in the art in view of thedrawings, specification, and claims hereof. Moreover, it should be notedthat the language used in the specification has been principallyselected for readability and instructional purposes, and may not havebeen selected to delineate or circumscribe the inventive subject matter,resort to the claims being necessary to determine such inventive subjectmatter.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates a system diagram of a Fibre Channel network with azone specified in an embodiment of the present invention.

FIG. 2 is a data flow diagram illustrating one manner for specifyingframe filtering and monitoring within the fabric in an embodiment of thepresent invention.

FIG. 3 is a block diagram of a system indicating an example of theconnections within a Fibre Channel fabric according to an embodiment ofthe present invention.

FIG. 3A is a more detailed block diagram of switches according to anembodiment of the present invention.

FIG. 4 is a block diagram of one embodiment of a switch suitable forframe filtering in accordance with the present invention.

FIG. 4A is a more detailed block diagram of one-half of the chips ofFIG. 4

FIG. 5A is a simplified block diagram of one embodiment of framefiltering logic contained in the transmit logic of FIG. 4A suitable forthe switch of FIG. 4.

FIG. 5B is a detailed block diagram of the frame filtering logic of FIG.5A;

FIG. 6 is a block diagram of an embodiment of the source and destinationcontent-addressable memories of FIG. 5B.

FIG. 7 illustrates a fabric switch with different devices zoned fordifferent protocols in an embodiment of the present invention.

FIG. 8 illustrates a block diagram of the overall operation of the zonegroup based filtering logic of FIG. 5B.

FIG. 9A illustrates a block diagram of one embodiment for implementingthe zone group filtering logic of FIG. 8.

FIG. 9B is a logic diagram of one embodiment for implementing the zonegroup filtering logic of FIG. 9A.

FIGS. 9C, 9D and 9E are block diagrams of a first embodiment of theextent logic of FIG. 5B;

FIGS. 9F and 9G are block diagrams of a second embodiment of the extentlogic of FIG. 5B;

FIG. 10A is a block diagram of a field definition block of FIG. 5B;

FIGS. 10B, 10C and 10D are block diagrams of a filter definition blockof FIG. 5B;

FIG. 11A is a diagram indicating one embodiment for implementing afilter definition term selection register in accordance with the presentinvention.

FIG. 11B is a table listing an embodiment of a set of SCSI LUN zoningframe filters in accordance with the present invention.

FIG. 12 is a flowchart illustrating one method for adding a specifiedzone configuration for a port in accordance with the present invention.

FIGS. 13A and 13B are flowcharts of a procedure for adding a singleD_ID-based zone group in an embodiment of the present invention.

FIG. 14 is a flowchart illustrating one method for enabling zoning for aspecified port in accordance with the present invention.

FIG. 15 is a flowchart illustrating one method for resetting the zoneconfigurations for a specified port in accordance with the presentinvention.

FIG. 16 is a flowchart illustrating one method for creating and deletingdynamic filters based upon a list assignment action in accordance withthe present invention.

FIG. 17 is a flowchart illustrating one method for processing a frozenfilter action in accordance with the present invention.

The figures depict a preferred embodiment of the present invention forpurposes of illustration only. One skilled in the art will readilyrecognize from the following discussion that alternative embodiments ofthe structures and methods illustrated herein may be employed withoutdeparting from the principles of the invention described herein.

DETAILED DESCRIPTION OF EMBODIMENTS

A system and method for deterministically filtering and routing framesover a fabric in a Fibre Channel communications network is described. Inthe following description, for purposes of explanation, numerousspecific details are set forth in order to provide a thoroughunderstanding of the invention. It will be apparent, however, to oneskilled in the art that the invention can be practiced without thesespecific details. In other instances, structures and devices are shownin block diagram form in order to avoid obscuring the invention.

Reference in the specification to “one embodiment” or to “an embodiment”means that a particular feature, structure, or characteristic describedin connection with the embodiments is included in at least oneembodiment of the invention. The appearances of the phrase “in oneembodiment” in various places in the specification are not necessarilyall referring to the same embodiment.

Some portions of the detailed description that follows are presented interms of algorithms and symbolic representations of operations on databits within a computer memory. These algorithmic descriptions andrepresentations are the means used by those skilled in the dataprocessing arts to most effectively convey the substance of their workto others skilled in the art. An algorithm is here, and generally,conceived to be a self-consistent sequence of steps (instructions)leading to a desired result. The steps are those requiring physicalmanipulations of physical quantities. Usually, though not necessarily,these quantities take the form of electrical, magnetic or opticalsignals capable of being stored, transferred, combined, compared andotherwise manipulated. It has proven convenient at times, principallyfor reasons of common usage, to refer to these signals as bits, values,elements, symbols, characters, terms, numbers, or the like.

It should be borne in mind, however, that all of these and similar termsare to be associated with the appropriate physical quantities and aremerely convenient labels applied to these quantities. Unlessspecifically stated otherwise as apparent from the following discussion,it is appreciated that throughout the description, discussions utilizingterms such as “processing” or “computing” or “calculating” ordetermining” or “displaying” or the like, refer to the action andprocesses of a computer system, or similar electronic computing device,that manipulates and transforms data represented as physical(electronic) quantities within the computer system memories or registersor other such information storage, transmission or display devices.

The present invention also relates to an apparatus for performing theoperations herein. This apparatus may be specially constructed for therequired purposes, or it may comprise a general-purpose computerselectively activated or reconfigured by a computer program stored inthe computer. Such a computer program may be stored in a computerreadable storage medium, such as, but is not limited to, any type ofdisk including floppy disks, optical disks, CD-ROMs, an magnetic-opticaldisks, read-only memories (ROMs), random access memories (RAMs), EPROMs,EEPROMs, magnetic or optical cards, application specific integratedcircuits (ASICs), or any type of media suitable for storing electronicinstructions, and each coupled to a computer system bus. Furthermore,the computers referred to in the specification may include a singleprocessor or may be architectures employing multiple processor designsfor increased computing capability.

The algorithms and displays presented herein are not inherently relatedto any particular computer or other apparatus. Various general-purposesystems may also be used with programs in accordance with the teachingsherein, or it may prove convenient to construct more specializedapparatus to perform the required method steps. The required structurefor a variety of these systems will appear from the description below.In addition, the present invention is not described with reference toany particular programming language. It will be appreciated that avariety of programming languages may be used to implement the teachingsof the present invention as described herein, and any references belowto specific languages are provided for disclosure of enablement and bestmode of the present invention.

Moreover, the present invention is claimed below as operating on orworking in conjunction with an information system. Such an informationsystem as claimed may be the entire frame filtering information systemas detailed below in the described embodiments or only portions of sucha system. For example, the present invention can operate with aninformation system that need only be a communications network in thesimplest sense to detect and route information. Thus, the presentinvention is capable of operating with any information system from thosewith minimal functionality, to those providing all of the functionalitydisclosed herein.

Reference will now be made in detail to several embodiments of thepresent invention, examples of which are illustrated in the accompanyingdrawings. Wherever practicable, the same reference numbers will be usedthroughout the drawings to refer to the same or like parts. U.S. Pat.No. 6,160,813 assigned to the same assignee as the present case ishereby incorporated by reference in its entirety.

Fibre Channel Network Structure

FIG. 1 illustrates a Fibre Channel network 100 with zones 176 and 178 ofdevices specified in an embodiment of the present invention. Generally,the network 100 is connected using Fibre Channel connections (e.g.,optical fiber and coaxial cable). In the embodiment shown and forillustrative purposes, the network 100 includes a fabric 102 comprisedof four different switches 110, 112, 114, and 116. It will be understoodby one of skill in the art that a Fibre Channel fabric may be comprisedof one or more switches.

A variety of devices can be connected to the fabric 102. A Fibre Channelfabric supports both point-to-point and loop device connections. Apoint-to-point connection is a direct connection between a device andthe fabric. A loop connection is a single fabric connection thatsupports one or more devices in an “arbitrated loop” configuration,wherein signals travel around the loop through each of the loop devices.Hubs, bridges, and other configurations may be added to enhance theconnections within an arbitrated loop.

On the fabric side, devices are coupled to the fabric via fabric ports.A fabric port (F_Port) supports a point-to-point fabric attachment. Afabric loop port (FL_Port) supports a fabric loop attachment. BothF_Ports and FL_Ports may be referred to generically as Fx_Ports.Typically, ports connecting one switch to another switch are referred toas expansion ports (E_Ports).

On the device side, each device coupled to a fabric constitutes a node.Each device includes a node port by which it is coupled to the fabric. Aport on a device coupled in a point-to-point topology is a node port(N_Port). A port on a device coupled in a loop topology is a node loopport (NL_Port). Both N_Ports and NL_Ports may be referred to genericallyas Nx_Ports. The label N_Port or NL_Port may be used to identify adevice, such as a computer or a peripheral, which is coupled to thefabric.

Loop devices (NL_Ports) coupled to a fabric may be either “public” or“private” devices that comply with the respective Fibre Channel standard(e.g., Fabric Loop Attach standard FC-FLA, or Fibre Channel Private LoopDirect Attach FC-PLDA, respectively). Those skilled in the art will befamiliar with the configurations for enabling public and private devicesto operate in compliance with ANSI specifications (e.g., X3.272 1996;T11 project 1133-D) and the NCITS specification (e.g., NCITS TR-20 1998;NCITS TR-19 1998).

Typically, private loop devices cannot log into an attached fabric andare thus incapable of communicating with other fabric devices. However,a well-suited method for allowing private loop devices to communicatewith public fabric-attached devices is disclosed in commonly assignedU.S. patent application Ser. No. 09/370,095, entitled “System and Methodfor Sending and Receiving Frames Between a Public Device and a PrivateDevice,” by Stai, el al., filed on Aug. 6, 1999, the subject matter ofwhich is hereby incorporated by reference in its entirety. In general,private addresses reside at the “end points” of the fabric, and uponentering a loop, frames having the format of the private address aretransformed to a format associated with a public address. This impliesthat there is a representation of private traffic in a public formatwhen a frame navigates through a loop. Thus, the discussion of framefiltering to follow applies to both public and private devices attachedto a fabric, as well as to frames having a representation in a publicformat of a private address.

In the embodiment shown in FIG. 1, fabric 102 includes switches 110,112, 114 and 116 that are interconnected. Switch 110 is attached toprivate loop 122, which is comprised of devices 126 and 124. Switch 112is attached to device 152. Switch 114 is attached to device 170, whichhas two logical units 172, 174 attached to device 170. Typically, device170 is a storage device such as a RAID device, which in turn may belogically separated into logical units illustrated as logical units 72and 174. Alternatively the storage device 170 could be a JBOD or just abunch of disks device, with each individual disk being a logical unit.Switch 116 is attached to devices 132 and 134, and is also attached topublic loop 162, which is formed from devices 164, 166 and 168 beingcommunicatively coupled together. A user interface 142 also connects tothe fabric 102.

Overview of Zoning within the Fibre Channel Network

Zoning is a fabric management service that can be used to create logicalsubsets of devices within a Storage Area Network, and enables thepartitioning of resources for the management and access control of frametraffic. A suitable method, performed at the software level (andreferenced to herein as “software zoning” or high-level softwarezoning), for the partitioning of fabric devices into several types ofzones is disclosed in commonly assigned U.S. patent application Ser. No.09/426,567 referenced above. In general, the software sets up zonesaccording to several different methods for specifying devices,including: (1) World Wide Name (WWN)-level zoning and (2) port-levelzoning. Generally, WWN-level zoning and port-level zoning may coexistacross a fabric or a switch so long as they do not overlap with eachother over a port. These various types of zoning are further discussedbelow.

1. World Wide Name (WWW)-Level Zoning

A WWN uniquely identifies a Fibre Channel node or port on a device.World Wide Names are specified as eight hex numbers separated by colons,for example 10:00:00:60:69:00:00:8A. When a device is a zone memberhaving a Node World Wide Name, all ports on that device are specifiedfor that corresponding zone. When a device is a zone member having aPort World Wide Name, a single port on the device is specified for thatcorresponding zone. Specifying zone members by World Wide Name isadvantageous because, for example, a device which is so specified may becoupled to the fabric at any point or via any fabric element and it willretain the same zone membership.

2. Port-Level Zoning

Port-level zoning is used when the fabric user has physical fabricport-level knowledge as to how the devices within the desired zone aregrouped. Physical fabric port numbers are specified as a pair of decimalnumbers “s,p”, where “s” is the switch number which may be indicated bya domain ID, and “p” is the port number on that switch. For example,“2,12” specifies port 12 on switch number 2. When a zone member isspecified by a physical fabric port number, then any and all devicesconnected to that port are in the zone. If this port is an arbitratedloop, then all devices on the loop are in the zone.

Overview of Frame Filters for Enabling Zoning

In accordance with the present invention, the creation of one or moresets of different frame filters are undertaken to trap selected framessent within a Fibre Channel fabric system and to perform differentactions based upon the selected frames. As will be discussed later indetail, frame filters may be based upon a variety of different framecharacteristics, including the class of service of a frame, the frameheader information, and the frame payload data (e.g., up to 2112 bytesaccording to the Fibre Channel standard). Generally, the overallobjective of the frame filtering schemes described herein is to discernand subsequently manipulate the most frequently encountered frames inthe switch hardware so as to maximize network communication performance.

One aspect of a frame filtering system and method in accordance with thepresent invention is the filtering of frames at wire speed. Wire speedis defined to mean the rate of data transfer that a giventelecommunication technology (herein, Fibre Channel) provides at thephysical wire level. Fibre Channel networks can support large data blocktransfers at gigabit speeds. Thus, implementing frame filtering on aFibre Channel network is a highly-attractive feature becauseframe-to-frame filtering can be performed at various wire speedthroughputs (e.g., 1, 2, and 10 Gbps), thereby improving communicationspeed.

One aspect of frame filtering, in accordance with the present invention,enables more sophisticated and more flexible zoning to be implemented atthe hardware level. This aspect of the present invention is beneficialbecause it improves security of communications in a Fibre Channelnetwork.

Another aspect of frame filtering in accordance with the presentinvention increases the variety of parameters that can be used to createzone groups. Previously, such parameters were unavailable withconventional software or prior hardware zoning techniques. With thepresent invention, zoning performed with frame filtering can be used toset up barriers between systems of different operating environments: (1)to deploy logical subsets of the fabric by creating closed user groupswith a finer granularity; and (2) to create a variety of test and/ormaintenance areas that are separate from the rest of the fabric.Additionally, frames may be filtered based on the class of service,frame header and a certain number of bytes of optional header or data.

Still referring to FIG. 1, a zone 176 is configured within the fabric102. Zone 176 includes devices 132, 134 and device 168, which forms apart of the arbitrated loop 162. Similarly, zone 178 includes device 152and logical unit 172. A zone indicates a group of source and destinationdevices allowed to communicate with each other. A zone group can beimplemented with filters set up to operate on frames sent between thedevices in the group. Source devices are identified by a sourceidentifier (S_ID), and destination devices are identified by adestination identifier (D_ID).

In one embodiment, the fabric can be configured by default to discardframes not sent within the same zone group. More particularly, thosedevices within a zone group can be permitted to communicate with eachother by filtering out frames sent between source and destinationdevices not within the same zone. For example, referring to system 100,only frames within zones 176 and 178 will be delivered, namely thoseframes sent between devices 132, 134 and 168 and these between device152 and logical unit 172. Accordingly, all other communicationsinvolving devices outside zones 176 and 178 will be discarded. Bycontrast, in another embodiment, the fabric may also be set up bydefault to forward all frames not within a zone group. In yet anotherembodiment, with reference to system 100, frames sent between deviceswithin a zone (e.g., 176 or 178) will be allowed to pass only if theymeet a particular frame filter criteria, such as a read-onlycommunication. In the situation where the default action for frames indifferent zone groups may be set to forward the frame, communicationsinvolving any devices outside the zone (e.g., 176 or 178) will proceedto be forwarded normally, and will not be subject to the “read-only”screening criteria.

Additional Levels of Zoning

In accordance with one aspect of the present invention, once the deviceswithin a zone have been specified using zoning to select eitherWWN-level or port-level, and corresponding identifiers, additionalsubsets may be added to the zone configuration further designating thetype of filter to place on the devices within the zone. This additionaldesignation of zone groups of devices can be based upon filteringcertain types of frames sent within the zone, and provides additionalvariety of zoning functionality previously unavailable with conventionalzoning techniques. For example, frames may be filtered based upon onetype of frame information, namely where logical unit number (LUN)information is specified, thereby allowing devices to be zoned at theLUN-level. Furthermore, frames can be filtered based on other types offrame information, namely enabling protocol-level zoning and accesscontrol level zoning. Still further, frame filters may also be createdto track different frame attributes for use in monitoring theperformance of the Fibre Channel network system. Generally, to implementthese additional levels of zoning, and as will be described in furtherdetail subsequently, a frame filter is set to reference a certainportion of a Fibre Channel frame by specifying a particular frame offsetand mask value.

A. LUN-Level Zoning

LUN-level zoning is implemented with filtering associated LUNinformation specified for the frame. For example, the informationspecified can include the device identifier information. Since theformat of LUN information for the Fibre Channel protocol (FCP) isvendor-specific and requires different types of filters to check thosebytes amongst the 8-byte LUN field for the FCP, zoning firmware (i.e.,the kernel software) will translate the LUN information within thefilter specification to ensure that the proper mask and offsetinformation is applied to the FCP LUN field. It is noted that LUNinformation may be stored differently among different vendors.

For SCSI Logical Unit zoning, an independent set of source devices isallowed access to each Logical Unit within a storage device. To keeptrack of the devices which are allowed to perform input/output (I/O)operation to the LUN, an access list for each Logical Unit having thesource IDs (S_ID) of the devices can be maintained.

It is desirable in some instances, to allow some devices read access,but not write access to certain LUNs within the SCSI storage device. Inorder to implement SCSI LUN-level zoning in a manner which maximizes theprobability that host adapter drivers will be able to communicate with aLUN-zoned storage device, certain commands directed at the storagedevice are forwarded to the switch processor (to be describedsubsequently), like for example, the Report LUNs SCSI command. Adetermination is made as to which LUNs within the device the source ofthe command is allowed to access; as part of the kernel software (i.e.,firmware) implementation in accordance with the present invention, thisset of LUNs can be returned as part of a function call in the responseto the intercepted Report LUNs command, thereby masking the availabilityof those Logical Units that the host is not allowed to access.

The particular action to be undertaken can be one of a variety ofactions, including forwarding a frame, sending a frame to a processor,discarding a frame and rejecting a frame. Certain fields can be examinedto determine a particular instruction to be undertaken. For example, therouting control (R_CTL) field indicates commands, responses and data.The destination device address (D_ID) field indicates the address of thedevice that the frame is destined for. The source device address (S_ID)field identifies the source device in order to determine whether thesource device is allowed access to the zone. The FC_TYPE fieldidentifies a frame protocol. FCP_CMND frames are those frames that haveFC_TYPE=8 and R_CTL=8. For FCP_CMND frames, the FCP_LUN field is aLogical Unit Number identifier. The FCP_CMND field includes a SCSIcommand field with read and write indicators. It is noted thatadditional fields can also be considered.

This application of frame filtering for LUN-level zoning is beneficialfor handling the most frequently encountered frames in the hardware soas to maximize performance. Other commands, especially those thatrequire higher level processing in order to issue proxy responses (e.g.,altering a Report LUNs command to only report LUNs the initiator ispermitted to access) are forwarded to the switch processor for handling.It is noted that when implementing SCSI LUN-level zoning,performance-sensitive commands include SCSI read commands, SCSI writecommands, and certain error recovery frames (e.g., Abort Sequence BasicLink Service). These commands are preferably handled in the hardware.

Protocol-Level Zoning

Protocol-level zoning is implemented with filtering that allows framesassociated with a particular Fibre Channel protocol (e.g., FC-4,FCP-SCSI, FC-IP) to be forwarded to their destination device, whileframes associated with other protocols to be discarded or rejected. Thisis desirable for applications such as those where storage and clusteringtraffic coexist on the same fabric so that the filtering function canprevent storage devices from receiving undesired clustering traffic.

Protocol filtering examines the FC_TYPE of the frame to determinewhether the frame matches a particular filter or not, although otherframe fields may certainly be examined as part of the filtering process.As an example, in the particular situation where a SCSI device is to beprotected from non-SCSI traffic, the following FC-TYPEs can be filteredto allow the frame to be forwarded: FC_TYPE=0 (basic link services);FC_TYPE=1 (extended link services); and FC_TYPE=8 (FCP). Frames withother FC_TYPEs can be accordingly rejected.

C. Access Control Level Zoning

Access control filtering distinguishes between read-only, write-only,and read/write types of frames. For example, with an FCP command, theframes contain the SCSI format in the payload (i.e., byte 0, SCSI CDB),which can be used to identify that access control is activated.

In addition to the subsets of filters previously described forLUN-level, protocol-level, and access control level zoning, additionalindividual filters may be set up for frames being passed between deviceswithin a designated zone. For example, one individual frame filter cancompare a particular frame offset location and mask against apre-specified value to determine if there is a match. Pre-specifiedactions are then undertaken based upon whether or not a match wasachieved. A combination of various frame filters can be set up toexamine any portion of the frame.

Zoning Configurations

In order to fully specify a frame filtering configuration for the fabricaccording to the preferred embodiment, two different sets ofconfiguration information can be specified. A first set of informationis the zone type and the second set of information is the zone groupsetup. As will be discussed below, the zone group and zone type shouldbe configured and initialized at the port transmitting the frames. Theoperations could also be performed at the port receiving the frames orany intermediate port, but such arrangements would be more complicatedso the transmit port location is preferred.

A. Zone Type

Configuration of the zone type setup entails actions being defined basedupon zone group hits and misses, along with a predetermined number offield hits and misses (e.g., 16), where preferably the size of eachfield can be up to the maximum frame size allowed by Fibre Channel. Eachof the fields is compared against possible filter values (e.g., up tofour). The actions defined for filter “hits” and “misses” comprise: (1)forwarding the frame; (2) discarding the frame; (3) setting upadditional filters; and (4) sending the frame to an embedded processorfor a final decision. Setting up a zone type can be implemented in avariety of manners. For example, configuring a zone type can be a simpleinstruction to forward any frame with a particular zone group hit. As amore complex example, configuration of a zone type can include aninstruction to forward all the FCP-DATA, RESPONSE, and TRANSFER READYframes regardless of their zone group hit or miss determinations, sincethese frames are solicited frames in the FCP context. One reason fordoing so stems from the notion that if the FCP-CMD frame that solicitedthese (FCP-DATA, RESPONSE, and TRANSFER READY) frames is able to enterthe zone, then other types of frames (i.e., FCP-DATA, RESPONSE, andTRANSFER READY) should be able to as well. Generally though, zone typespecification can be configured for port-level zoning or WWN-levelzoning, along with a zone suffix specification indicating LUN-levelzoning, protocol-level zoning and access control level zoning.Correspondingly, filters for the specified zone type can be setup for aport.

B. Zone Group

Configuration of the zone group encompasses a set of fields with certainproperties and values being grouped into a zone. For example, thesefields can include S_ID, D_ID, LUN, and FC_TYPEs. More specifically, thezone group specifies the sets of source and destination devices (e.g.,indicated by S_ID and D_ID) that can communicate with each other,including a specific LUN and FC_TYPE, if these fields are to bespecified. A frame communication that falls within a specified zonegroup is referred to as a “zone group hit” whereas a frame communicationthat does not fall within a specified zone group is referred to as a“zone group miss.”

Furthermore, zone groups can be divided into multiple subgroups, where ahit or miss can be used to determine a hit or miss of a filter. Anexample of the use of subgroups is for access control filtering. In aparticular implementation of these subgroups, one subgroup could be usedas a read only zone group, while the other subgroup could be used as aread/write zone group. Hardware constraints which limit the number ofzone groups shared by a limited number of physical ports can be overcomeby virtual translation in the firmware (as will be discussedsubsequently).

C. Zoning Examples

For WWN-level zoning, all involved ports in the fabric are configuredwith the zone type of WWN zoning. As an example, for WWN-level zoning,after the zone type configuration, zone groups should be configured (ifany) based on information from the name server. Otherwise, for thosedevices not yet logged into the name server, configuration should beimplemented after the devices log into the fabric and name server.

For port-level zoning, the zone type and corresponding zone groups areconfigured at all ports in which port-level zoning is involved. Theframe filter can be set up such that the zone group is always used todetermine whether a frame is to be forwarded or discarded, whether theframe is solicited or unsolicited in the FCP context. For example,certain field bits (e.g., the higher 16-bits of the S_ID field of eachframe can be checked against other bits in another field (e.g., thehigher 16-bits of the D_ID field). If there is a match of theseparameters to the zone group, the frame will be forwarded.

For LUN-level zoning, in addition to the filter set up as describedabove, the FC_TYPE and up to four bytes into the LUN fields can be usedto determine a zone group hit or miss. In this particularimplementation, LUN information can be used in specifying the zone groupmembers.

One Implementation of Frame Filtering

FIG. 2 illustrates a data-flow diagram of one manner that is suitablefor programming a Fibre Channel fabric at the hardware level with framefiltering capabilities in accordance with the present invention. Zonegroup and zone type configuration information are entered into a userinterface 180, which may log into any switch within the fabric 102 toenter the configuration information. Referring back to FIG. 1, variousfabric zone configurations can be input into fabric 102 through userinterface 142 to allow a user to select different types of framefiltering capabilities. In one embodiment, user interface 142establishes a command-based Telnet session with fabric 102. In anotherembodiment, the user interface 142 comprises a Web-based interfaceallowing a user to select the configuration of fabric 102 throughpoint-and-click and dialog sessions. One of skill in the art willrecognize that various other embodiments of a user interface 142suitable for configuring a fabric with frame filtering will worksuitably-well with the present invention.

Referring back to FIG. 2, the configuration information is sent to theframe filtering midware software 185, which is resident on one or moreof the switches within the fabric. The midware manages zones at thefabric level. The midware checks for zone conflicts and warns the userif any conflicts exist. It is noted, however, that WWN-level zoningconflicts cannot be checked until all devices log into the fabric. Thusconflicts arising from improper WWN zoning inputs are flagged to theuser at a later time. For WWN-level zoning, the zone group may becompleted after the devices log into the fabric.

The midware software sets up zone groups and any zone that conflictswith another zone will not be set up. The midware software alsodetermines what type of zoning each port is supposed to enforce. At thelevel of the midware, the zone type configuration setup can beabstracted into zone type specification (e.g., port-level zoning orWWN-level zoning) along with a zone suffix specification (e.g., LUNlevel zoning, protocol level zoning and/or access control.)

The frame filtering firmware 190 (used interchangeably with “kernelsoftware”), resident on each individual switch, receives midwareinformation that is relevant to the zoning and filter setup for thatparticular switch. The switch firmware 190 programs the final framefilters into the appropriate switch hardware 195. The physical hardware195 (used interchangeably with “real hardware”) performs the framefiltering actions in accordance with the present invention, althoughcertain types of frames are sent to the switch processor (to bedescribed subsequently) for additional manipulations when necessary.

It is noted that the hardware 195 resident on the switch is a finiteresource, and only a limited number of frame filters or zone groups canreside in the hardware 195 at any given time. If additional framefilters or zone groups are desired, they may be stored in the firmware190 as “virtual” storage and may be input into the real hardware 195when necessary. The real hardware structures represented by hardware 195will be described first herein, followed by the initialization routinesfor both the real hardware and “virtual” memory structures.

A. An Embodiment for Hardware 195

FIG. 3 is a block diagram of a system 228 indicating an example of theconnections used within a Fibre Channel fabric according to anembodiment of the present invention. In the example shown, system 228includes two switches 240 and 230, a device 260 and a device 250. Switch240 includes a central processing unit (CPU) 246 for managing itsswitching functions, and switch 230 includes a CPU 236 for managing itsswitching functions. Switch 240 includes two ports 242 and 244; switch230 includes two ports 232 and 234. The number of ports shown on eachswitch is purely representative; and it will be evident to one ofordinary skill in the art that a switch may contain more or fewer ports.Device 260 is communicatively coupled via its node port 262 to port 242on switch 240. Device 250 is communicatively coupled via its node port252 to port 234 on switch 230. Switch 240 and switch 230 areinterconnected via ports 244 and 232.

In this particular implementation, frame filtering is performed at theport where a frame is to be transmitted out of a switch, hence theconfiguration of the zone groups and zone types are set up at thetransmitting port of a frame. Two examples are provided forillustration. In one example, the source and destination ports arewithin the same switch. More specifically, a frame is traveling fromport 242 to port 244, where port 244 is the transmitting or egress portfrom the point of view of switch 240. In this example, the zone typesand corresponding zone groups are set up on port 244. In anotherexample, the destination port is across multiple switches. Morespecifically, a frame is traveling from device 260 to device 250. Fabricports are candidates for frame filtering set-up. Within the fabric, theframe travels from port 242, to port 244, to port 232, and to port 234.Zone group and zone type information may be configured on either port242 of switch 240 or port 234 of switch 230. However, it is generallypreferable to set up frame filtering at the end point of the destinationpath (i.e., port 234 in this example.) A fabric may contain multiplepaths to reach a destination device across the switches comprising thefabric, and therefore it is prudent to set up frame filtering at thefabric end point connection to the destination device to ensure that allframes traveling on all routes to the destination device are properlyfiltered.

FIG. 3A illustrates a basic block diagram of a switch 200, such asswitches 110, 112, 114, 116, 230 or 240 according to the preferredembodiment of the present invention. A processor and I/O interfacecomplex 202 provides the processing capabilities of the switch 200. Theprocessor may be any of various suitable processors, including the Inteli960 and the Motorola PowerPC. The I/O interfaces may include low speedserial interfaces, such as RS-232, which use a driver/receiver circuit204, or high-speed serial network interfaces, such as Ethernet, whichuse a PHY circuit 206 to connect to a local area network (LAN). Mainmemory or DRAM 208 and flash or permanent memory 210, are connected tothe processor complex 202 to provide memory to control and be used bythe processor.

The processor complex 202 also includes an I/O bus interface 212, suchas a PCI bus, to connect to Fibre Channel circuits 214 and 216. TheFibre Channel circuits 214, 216 in the preferred embodiment each containeight Fibre Channel ports. Each port is connected to an external SERDEScircuit 218, which in turn is connected to a media interface 220, whichreceives the particular Fibre Channel medium used to interconnectswitches used to form a fabric or to connect to various devices.

B. Configuration of a Switch

FIG. 4 is a block diagram of one embodiment of a switch 200 suitable forperforming frame filtering in accordance with the present invention.Switch 200 includes a processor, namely CPU 202, and two Fibre Channelintegrated circuit “chips” 214 and 216, which chips may be referred toas “Bloom” chips. Logically, the chips 214 and 216 are divided into“half-chips” that are each capable of supporting frame filtering forfour different ports. Chip 214 includes two half-chips 410A and 410B.Half-chip 410A supports ports 412A, 414A, 416A and 418A. Half-chip 410Bsupports ports 412B, 414B, 416B and 418B. Chip 216 includes twohalf-chips 420A and 420B. Half-chip 420A supports ports 422A, 424A, 426Aand 428A. Half-chip 420B supports ports 422B, 424B, 426B and 428B. Inthe example used herein, the frame filtering logic is duplicated foreach half-chip. Each half-chip is capable of supporting four ports, andthus the half-chip based logic is referred to as “quad-based” logic.Certain parts of the frame filtering logic are duplicated for each port,and this logic is “port-based” logic.

FIG. 4A illustrates a simplified block diagram of one-half of thepreferred embodiment of the Fibre Channel circuits 214 and 216. ThusFIG. 4A is duplicated inside each Fibre Channel circuit 214, 216.Various components serve a similar function as those illustrated anddescribed in U.S. Pat. No. 6,160,813, which is hereby incorporated byreference in its entirety.

Each one-half of Fibre Channel circuit 214 and 216 includes fouridentical receiver/transmitter circuits 300, each circuit 300 having oneFibre Channel port, for a total of four Fibre Channel ports. Eachcircuit 300 includes a SERDES serial link 218, preferably locatedoff-chip but illustrated on chip for ease of understanding;receiver/transmitter logic 304 and receiver (RX) routing logic 306.Certain operations of the receiver/transmitter logic 304 are describedin more detail below. The receiver routing logic 306 is used todetermine the destination physical ports within the local fabric elementof the switch 200 to which received frames are to be routed.

Each receiver/transmitter circuit 300 is also connected to statisticslogic 308. Additionally, Buffer-to-Buffer credit logic 310 is providedfor determining available transmit credits of virtual channels used onthe physical channels.

Received data is provided to a receive barrel shifter or multiplexer 312used to properly route the data to the proper portion of the centralmemory 314. The central memory 314 preferably consists of thirteenindividual SRAMs, preferably each being 10752 words by 34 bits wide.Each individual SRAM is independently addressable, so numerousindividual receiver and transmitter sections may be simultaneouslyaccessing the central memory 314. The access to the central memory 314is time sliced to allow the four receiver ports, sixteen transmitterports and a special memory interface 316 access every other time sliceor clock period.

The receiver/transmitter logic 304 is connected to buffer address/timingcircuit 320. This circuit 320 provides properly timed memory addressesfor the receiver and transmitter sections to access the central memory314 and similar central memory in other duplicated blocks in the same orseparate Fibre Channel circuits 216, 218. An address barrel shifter 322receives the addresses from the buffer address/timing circuits 320 andproperly provides them to the central memory 314.

A transmit (TX) data barrel shifter or multiplexer 326 is connected tothe central memory 314 to receive data and provide it to the propertransmit channel. As described above, several of the blocks of FIG. 3can be interconnected to form a full eight port circuit or two eightport circuits. Thus transmit data for the four channels illustrated inFIG. 4A may be provided from similar other circuits.

This external data is multiplexed with transmit data from the transmitdata barrel shifter 326 by multiplexers 328, which provide their outputto the receiver/transmitter logic 304.

In a fashion similar to that described in U.S. Pat. No. 6,160,813,RX-to-TX queuing logic 330, TX-to-RX queuing logic 332 and a centralmessage interface 334 are provided and perform a similar function, andso will not be explained in detail.

The half-chip logic that forms an integrated circuit as embodied inswitch 200 of FIG. 4 and half-chip of FIG. 4A is purely illustrative. Itwill be evident to one of ordinary skill in the art that different typesof chips may be designed to support frame filtering. For example, thechip may be designed to logically support more or fewer ports. Theswitch itself may include more or fewer chips per switch. Additionally,it will become evident that, for clarity and without loss of generality,only selected portions of switch 200 and half-chip are illustrated inFIGS. 4 and 4A.

C. Frame Filtering Logic for Implementing Zones

1. An Implementation for the Hardware

Referring to FIG. 5A, a simplified block diagram is illustrated for oneembodiment of frame filtering logic 500 that can be included in hardware195 for switch 200 in order to perform the filtering and routing offrames in accordance with the present invention. Frame filtering logic501 is communicatively coupled to a FIFO memory 502; a central memory504 which is equivalent to central memory 314; and transmit (TX) logic570, which is contained in the receiver/transmitter loop logic 304. TXlogic 570 is that component of switch logic which enables frames orprimitive sequences to be transmitted to one or more destination devicesaccording to Fibre Channel protocols. It is noted that FIFO 502 obtainsthe frame from central memory 504 and is synchronized with the filteringlogic 501 in order to determine whether a frame should be transmitted ornot from TX Logic 570. If the decision is made not to transmit theframe, the filtering logic 501 will send a signal to kill the frame atTX Logic 570, which is in the receiver/transmitter loop logic 304. TheFIFO queue 502 and Filtering Logic 501 are logically grouped together toform block 503, which is located in the transmit data path just beforethe receiver/transmitter logic 304.

In FIG. 5B, a block diagram of an embodiment for the logic of block 501of a half-chip 410A suitable for frame filtering in accordance with thepresent invention is shown. Block 501 is connected to central memory504, which feeds portions of the data stream into zone group framefiltering logic 505 for analysis. The zone group frame filtering logic505 receives various fields from a transmitted frame and applies them todifferent frame filtering blocks, as described below.

Within the half-chip 410A, the set of zone group based filtering logic505 includes a source content addressable memory (CAM) 510 (SCAM 510)and a destination CAM 520 (DCAM 520), a source group random accessmemory (RAM) 512, a destination group RAM 522, zone group combinationlogic 530 and extent logic 534. In the embodiment shown, the zone groupbased filtering logic 505 is quad-based logic and shared by all fourports in the quad, although it will be understood by one of skill in theart that the filtering logic may be designed to support more or fewerports. Half-chip 410A also includes four sets of port-based logic(corresponding to the four ports of half-chip 410A, as shown in FIG. 4).The central memory 504 is coupled to field definition blocks 550A, 550B,550C and 550D. Each field definition block 550A-D can be implemented asa set of 16 field control registers indicating which frame sections toexamine. For discussion purposes herein, field definition blocks 550A-Dwill be used interchangeably with field control registers. The outputsof the field definition blocks 550A, 550B, 550C, and 550D are coupled tofilter definition blocks 540A, 540B, 540C and 540D, as is the output ofthe zone group combination logic 530. Each filter definition block 540A,540B, 540C and 540D specifies a set of individual frame filters, forexample 32 frame filters. Individual frame filters are configured toreceive the output of the zone group logic 530 and from a fielddefinition block 550A, 550B, 550C or 550D. Each individual frame filtercombines a group of field control register hits or misses with hits ormisses generated in the zone group combination logic 530. Along with theindividual frame filter criteria already discussed, an action is alsospecified for each individual filter.

In the following discussion, the zone group based filtering logic 505will be discussed first, followed by the field definition blocks 550A-Dand the filter definition blocks 540A-D. The zone group based filteringlogic 505 is used to find intersections between lists of specific framefields. This is done by using CAMs 510 and 520, each of which contains acollection of frame fields from each of the lists to be analyzed. Forexample, with SCSI LUN level zoning, the SCAM 510 normally contains theset of 24-bit Fibre Channel frame S_IDs that comprise all access listsfor LUNs serviced by the frame filtering logic. In addition, each entryin the DCAM 520 contains a Fibre Channel frame D_ID plus a SCSI LUNwithin the corresponding destination device. In this manner, the DCAM520 contains the entire set of SCSI LUNs across multiple SCSI targetsthat may be processed by the frame filtering logic. This is showndiagrammatically in FIG. 6.

One manner for implementing the zone group based filtering logic 505 isdiscussed as follows. SCAM 510 lists S_ID and FC_TYPE sets indicatingsource devices (with an optional FC_TYPE specification) that have sometype of frame filtering logic specified for at least one of the portsattached to the half-chip containing this SCAM 510. For example, theDCAM 520 lists LUN number, physical transmitter port, FC_TYPE and D_IDsets to indicate the relevant destination targets for the groupfiltering logic 501. If a particular FC_TYPE specification is notdesired, a “protocol wildcard” (e.g., FC_TYPE=FF) may be enabled so thatthe FC_TYPE in the frame header will not be checked in order to obtain aCAM hit. The source group RAM 512 includes two zoning group bitmaps,namely Subgroup A and Subgroup B. Bits are set in each zoning groupbitmap to indicate to which of the Subgroup zones the corresponding S_IDbelongs. The destination group RAM 522 also includes two zoning groupbitmaps, namely Subgroup A and Subgroup B. Bits are set in each zoninggroup bitmap to indicate to which of the Subgroup zones thecorresponding D_ID belongs.

In one embodiment of the present invention: SCAM 510 includes 64 entriesfor the S_ID and FC_TYPE; DCAM 520 includes 512 entries of the LUNnumber, physical transmitter port, FC_TYPE, and D_ID; the source groupRAM 512 contains 128 entries of Subgroups A and B; and the destinationgroup RAM 522 contains 128 entries of Subgroups A and B.

2. Operation of Frame Filtering

Still referring to the operation of the SCAM 510 and DCAM 520 shown inFIG. 6, a frame is read from central memory 504 into filtering logic 501prior to being transmitted by the TX logic 570. Central memory 504provides copied frame fields to the SCAM 510 and the DCAM 520. For SCAM510, the S_ID and FC_TYPE fields from the frame header are captured asthey are being read from central memory 504. The S_ID and the FC_TYPEare combined into the SCAM format and are compared with the predefinedentries in the SCAM 510. A matching SCAM 510 entry results in an addressbeing output, the address providing an index (802 as shown in FIGS. 8and 9A) into the source group RAM 512. In a similar fashion, as theFC_TYPE, D_ID and LUN fields of the frame are read from central memory504, they are captured for the DCAM 520. The actual LUN fields capturedare based on the values present in a LUN offset register, which includesentries for FC_TYPE as well as multiple offsets to capture variousportions of the packet to obtain LUN information. This flexibility ofLUN value location identification allows customization for particularFC_TYPES and other variations in packets. In the preferred embodiment, acorresponding mask bit specifies if a byte should be ignored whenperforming a compare with a frame. There are four different offsets,which can be used to select any 4 bytes within the maximum offset of2112 (though many of these bytes are not necessarily the LUN number).Certain bits in this register represent the FC_TYPE, which specifiesthat the LUN number will only be checked if the FC_TYPE matches.Otherwise, the LUN number will be ignored for other non-matchingFC_TYPEs. A matching DCAM 520 entry results in an address being output,the address providing an index (806 as shown in FIGS. 8 and 9A) into thedestination group RAM 522.

The source and destination group RAMs 512 and 522 (collectively referredto as the “zone group RAMs”) both include two different zoning SubgroupsA and B to facilitate different levels of access capabilities. Forexample, Subgroup zones may be used to permit different source devicesto be zoned for either read access or write access to a particular LUN.A first set of source devices, belonging to groups defined by theSubgroup A bitmap, would be allowed read access to a given LUN. A secondset of source devices (some of which may overlap with the first set ofsource devices) defined by the Subgroup B bitmap, would be allowed writeaccess to a given LUN. Because the source and destination group RAMs512, 522 are part of the zone group based filtering logic 501 which isquad-based, only two different Subgroups may be defined for a given setof four ports controlled by the quad-based filtering logic.

Each zone group has at minimum one S_ID, FC_TYPE pair and at minimum oneD_ID, FC_TYPE, FCP_LUN set, some values of which may be wild cards.Whenever a new zone group is created, merging is performed within eachSubgroup. This process is best explained by referring to an example. Inthe example, FIG. 7 illustrates a Fibre Channel system having a switch700 including three ports 701, 702 and 703. Source device S1 isconnected to port 703. Destination devices D1 and D2 are connected toport 701. Destination devices D3 and D4 are connected to port 702. Framefiltering is configured for switch 700 such that destination devices D1and D3 may receive only read-only frames from source device S1, whiledestination devices D2 and D4 may receive both read and write accessframes from source device S1. The source and destination devices arezoned in the following manner. Information regarding devices D1 and D3is merged into Subgroup A, which is designated as being used forread-only access. Information regarding devices D2 and D4 is merged intoSubgroup B, which is designated as being used for read/write access. Itwill be appreciated by one of ordinary skill in the art that variousother types of access combinations may be assigned to the two zone groupSubgroups. In addition, the two zone group Subgroups A, B may bedesignated to indicate other types of filtering information. In anotherembodiment, the two Subgroups may be combined to allow for a larger setof zone groups. It is noted that ports 701 and 702 are part of the samehalf-chip so that merging is implemented in a simple and cost-effectivemanner.

3. Further Details of the Zone Group Based Filtering Logic 501

FIG. 8 illustrates the operation of the zone group based filtering logic501 in more detail. As frame fields S_ID and FC_TYPE, represented by504′, are transmitted from the central memory 504 to the filtering logic501, the frame fields are compared with entries in the SCAM 510. A match(i.e., “source CAM hit” 802) provides an index into the source group RAM512. If no match is found, a “source CAM miss” signal 804 is generatedand sent to the filter definition blocks 540. Similarly, frame fieldsD_ID, FC_TYPE and LUN, represented by 504″ are fed into filtering logic501 from central memory 504, and are compared with entries in the DCAM520, whereupon a destination CAM hit 806 or miss 808 are generated.

When the CAM indexes into the source group RAM 512 and the destinationgroup RAM 522, each output bits corresponding to each Subgroup. The zonegroup combination logic 530 is used to examine the outputs 810, 812,814, 816 from the source group RAM 512 and the destination group RAM522, respectively, to calculate a large series of alternatives,including whether the source and destinations are or are not in a commonzoning group. The preferred full list of alternatives is shown in FIG.11A, described more fully below. The results of the calculation areforwarded to the filter definition blocks 540.

An example of the operation of the zone group combination logic 530 isillustrated in FIGS. 9A and 9B. The source group RAM 512 outputs bitmaps810 for Subgroup A, and bitmaps 812 for Subgroup B. The destinationgroup RAM 522 outputs bitmaps 814 for Subgroup A and bitmaps 816 forSubgroup B. The zone group combination logic 530 performs bitwise ANDoperations on the outputs for each Subgroup. For simplicity and withoutloss of generality, FIG. 9A shows a single bit for the bitmaps 810, 812,respectively, as being a 1 for Subgroup A and a 1 for Subgroup B.Similarly, only a single bit is shown for bitmaps 814, 816,respectively, as being a 0 for Subgroups A and a 0 for Subgroup B. Inthis example, for both Subgroups A and B, the result of 1 AND_(bitwise)with 0 is 0; as a result, a bit is not set for either Subgroup, andthere is no zoning group to which both the source and destination LUNdevice belongs. FIG. 9B is a logic diagram illustrating an embodimentfor implementing the bitwise AND operations described in FIG. 9A. Asshown in the embodiment, combination logic 530 can be implemented by theconventional AND and OR gates as will be familiar by those skilled inthe art. It will become evident to those skilled in the art that thecircuitry illustrated in FIG. 9B is provided for each Subgroup of thesource and destination RAMs 512, 522, although not explicitly shown.

If there is no intersection (a zone group miss) between the source groupRAM 512 and the destination group RAM 522, the firmware may have toupdate the zone bit map in both zone group RAMs. To maintain timingconsistency, the RAMs 512, 522 should not be accessed while they arebeing updated. Preferably, frame transmission from the TX logic 570 andqueue (FIFO 502) is disabled while the RAMs 512, 522 are being updated.Additional zone group information may be located in a virtual memory. Aswill be discussed in greater detail subsequently, a virtual memory canbe used to overcome limited hardware resources. In particular, if avirtual memory is being used, additional zone group information may beswapped into the hardware structures when it is needed.

Referring then to FIG. 9C, a zone extent check register 2000 is shown.Preferably the register 2000 is 128 bits wide, one bit for each entry inthe source and destination group RAMs 512, 522. A true value in a bitindicates that particular bit defined by the group RAM location isextent-limited, while a false value indicates it is not. Referring toFIG. 9D, a series of extent start and end value registers 2004 areshown. In this embodiment four extents can be provided for each instanceor bit, with start and end values defined for each extent. Thus, thereare 512 start and end value pairs in registers 2004.

Referring to FIG. 9E, one of 128 similar extent logic blocks 2001 isshown, one for each bit of the group RAMs 512, 522. An AND gate 2002receives the relevant extent bit from the register 2000 and the SID,DID, LUN match bit from the zone group combination logic 530. As anexample using bit or zone 1, the extent 1 start value 2006 is providedto one input of a comparator 2008. The second input of the comparator2008 receives the starting value of the block requested in theparticular frame. The output of the comparator 2008 is true if the blockvalue is greater than or equal to the extent 1 start value. The extent 1end value 2010 is provided to one input of a comparator 2012, with theother input receiving the block end value for the frame. The block endvalue Is developed by adding the transfer length to the block start. Theoutput of the comparator 2012 is true when the block end value is lessthan or equal to the extent end value. The outputs of the comparators2008 and 2012 and the AND gate 2002 are provided to an AND gate 2014.Thus AND gate 2014 is true if the zone is extent-limited and the blockof the frame is within extent 1. Similar comparators and AND gates areprovided for the other potential ranges of zone 1. This computation isused only for operation command frames. The proper location in thepayload of the command frame is retrieved together the block startaddress and the request length. Optionally, this can be done on everyframe and then qualified with a field definition block output asdescribed below.

The output of AND gate 2014 and the remaining AND gates for zone 1 areprovided to an OR gate 2016. A true value for OR gate 2016 indicates avalid extent-limited zone hit for zone 1. The zone 1 extent hit valuecan then be used as the twelfth and thirteenth zone group combinationlogic value, as shown in FIGS. 10B and 11A.

To disable an extent range the start value can be set to the maximum andthe end value can be set to the minimum (or the start may be set greaterthan the end). Alternatively, a bit could be provided and used as aninput to the AND gate 2014.

Similar register entries, comparators, AND gates and OR gates areprovided for each zone. While four extent ranges have been shown, adifferent number could be provided if desired.

In some cases it may be desired to have a large number of LUN extents ina single LUN as a zone. While additional registers and comparators asdescribed above could be used, that approach quickly becomes costprohibitive due to the number of gates needed. An alternative embodimentis shown in FIGS. 9F and 9G. In this embodiment a link list of extentvalues is provided. A series of zone extent start address registers 2020is provided. Each entry provides the starting address for the link listfor that zone or group RAM 512, 522 bit location. AND gate 2002 is againused. The output of the AND gate 2002 is a WAIT signal which indicates aneed to delay or wait final evaluation of this zone until the extentchecking is complete. The AND gate 2002 output is also provided to the Dinput of a flip-flop 2040. The clock signal is provided by system clocksignal. The non-inverted output of the flip-flop 2040 is provided to theselection input of a multiplexer 2022. The zone 1 extent start addressis provided to the zero input of the multiplexer 2022. The output of themultiplexer 2022 is provided as the addresses of a RAM 2024. The datavalues for each RAM entry are the extent start value <o . . . a>, theexent end value <a . . . b>, and the next address value <b . . . n>. Thenext address values <b . . . n> of the addressed location are providedto the D inputs of a set of flip-flops 2026 to store the address as thelink list is traversed. The outputs of the flip-flops 2026 are providedto the second or one input of the multiplexer 2022. The next addressvalues <b . . . n> are also provided to a NOR gate 2036. The output ofthe NOR gate 2036 is one input of an AND gate 2028, whose output isprovided to the clock input of the flip-flops 2026. Another input to theAND gate 2028 is the system clock signal.

The extent start values <0 . . . a> are provided as an input to acomparator 2030, whose second input is the block start value. Thecomparator 2030 output is true if the block start value is greater thanor equal to the extent start value. The extent end value <a . . . b> isprovided as one input to a comparator 2032, whose other input receivesthe block end value, determined as described above. The output ofcomparator 2032 is true if the block end value is less than or equal tothe extent end value. The outputs of the comparators 2030 and 2032 areprovided to an AND gate 2034, which also receives the AND gate 2002output. The output of the AND gate 2034 is true for an extent hit. TheAND gate 2034 output is also an inverted input to the AND gate 2028, sothat the link list is traversed each clock period until a hit isdetermined or a next address value of zero is obtained. NOR gate 2036output is also one input of an OR gate 2038. The other input of the ORgate 2038 is the output of the AND gate 2034, the extent hit signal. Theoutput of the OR gate 2038 is the PROCEED signal to indicate that thecomparison of the link list for the zone is completed and the zone canbe evaluated. Both the WAIT and PROCEED signals are provided to otherportions of the filtering logic 501 so that frame processing is delayeduntil the PROCEED signal is received, indicating completion of the zonehit analysis.

This has been the logic for a single zone and is repeated for each zone.The RAM 2024 can be individual for each zone or can preferably be sharedbetween zones.

The output of the zone group based filtering logic 501 indicates thedetails of the CAM hits and misses, and whether there was a common zonegroup for the frame in question. This information is input to the FilterDefinition Blocks 540A-D, along with the information from the FieldDefinition Blocks 550A-D.

4. Field Definition Blocks 550

In one embodiment previously mentioned, each field definition block 550comprises a set of field control registers. The field definition blocks550 define an offset and actual values to compare against frame values,which is defined generally to mean that the blocks 550 are used by theframe filtering logic to compare various fields in the frames beingtransmitted against a set of pre-specified values programmed into theset of field control registers by the firmware.

For example, certain bits of the field control registers define a byteoffset into the frame of the field to be examined starting at thebeginning of the frame header, other bits define different field valuesagainst which specified frame fields are to be compared and yet otherbits define a mask representing which field values are to be used. As aframe is transmitted, the bytes in the transmitted frame at the offsetspecified in the field control register are copied into a holdingregister. The mask, if one is specified in field control register, isthen applied to the contents of the holding register. The result of thiscomputation is then compared against each of the field values specifiedin the field control register. Responsive thereto, a set of signals isproduced for use by the corresponding filter definition block 540,indicating which, if any, of the field values matched the masked fieldsfrom the frame. The field control registers are shown in block diagramform in FIG. 10A.

In the preferred embodiment there are sixteen field control registersper port. A reduced number of these field control registers are shown inFIG. 10A. The preferred four bytes of frame data based on the definedoffset value are contained in holding register 602. The four particularbyte values are contained in register 604. The four byte values arecompared to the four bytes in the holding register 602 by fourcomparators 606 a-d. Additionally, the mask value for each value isshown logically as also being provided to the comparators 606 a-d, wherethe comparator 606 a-d provides a true or one output if masked. Thecomparator 606 a-d outputs are the field value compare outputs providedto the respective filter definition block 540. The design of FIG. 10A isa logical representation of the operation of the field controlregisters, with actual implementations being readily developed.

One aspect of the present invention is the flexibility provided by thefield control registers represented by blocks 550A-D. That is, inaddition to the previously described filters which can be developed fromthe zone group logic 505, many different types of frame filters can beconfigured by using the field control registers alone or in combination.This can be more fully understood when the operation of the filterdefinition blocks 540A-D is explained.

5. Filter Definition Blocks

FIGS. 10B and 10C illustrate the operation of a filter definition block(e.g., 540A). The filter definition block 540A receives inputs from thefield control registers, that is, from field definition block 550A, andfrom zone group based filtering logic 505. These inputs are supplied toa group of individual frame filters, preferably 32 per port in thepreferred embodiment. An exemplary frame filter 650 is shownschematically for illustrative purposes. The frame filter 650 is brokendown into two portions, one relating to the zone group logic 505 and onerelating to the field definition block 550. For example, registers 1100,1102 shown in FIG. 11A, respectively include a portion for zonegroup-based logic term selection 1020 and a portion for field definitionterms selection 1010. As part of the provision of filter definitionselection, group-based logic term selection 1020 comprises indicatorsrepresenting, for example: (1) a CAM mismatch; (2) that both the sourceand destination belong to a common zoning group in Subgroup B; (3) thatthere was a match in the DCAM; (4) there is a LUN extent hit or (5) thesource, destination and LUN belong to a common zoning group in eithersubgroup A or subgroup B and there was no LUN extent hit. More examplesare shown in the registers of FIG. 11A. It will be evident to one ofskill in the art that a variety of different group based logic terms maybe selected. The field definition term selection 1010 portion of thefilter term selection register 1102 indicates which field controlregister values to consider. More than one field control register valuemay be linked together with an OR operation within each term. An exampleof the field definition term selection 1010 is shown in filterdefinition term selection register 1102 of FIG. 11A.

Referring back to FIGS. 10B and 10C, each individual frame filter 650 isa series of combinatorial logic whose outputs are combined by prioritylogic 660. Conceptually, there are thirteen multiplexers 652 tocorrespond to the thirteen combinations for the zone group termselections 1020. Conceptually, there are sixteen AND/OR gates 653 forthe sixteen field definition selections 1010, though each of thoseAND/OR gates may include logic to negate the particular output.

In more detail, the zone group term multiplexer 652 receives theappropriate zone group combination logic output at the one input and hasa logic true value at the zero input. The enable bit from the filterdefinition term register is used to select the input, with the outputbeing connected to an AND gate 651 which combines all of the terms forthe particular frame filter.

As an additional detailed example, the field value compare output for aparticular field is provided as one input to an AND gate 654. The enablebit for that field value from the filter definition term register is thesecond input to the AND gate 654. Similar AND gates are provided for theother field values for that particular field definition block output.The outputs of the AND gate 654 and the other AND gates are the inputsto an OR gate 656. The non-inverted output of the OR gate 656 isprovided to the zero input of a multiplexer 658, while the invertedoutput is provided to the one input. The input selection of themultiplexer 658 is provided by the NEGATE bit from the filter definitionterm register. The output of the multiplexer 658 goes to the AND gate651. Thus, the individual field register values are ORed together, withthat output potentially negated. If the NEGATE bit is true and each ofthe enable bits are zero, the output of the multiplexer 658 will alwaysbe true.

The outputs of the 32 frame filters for each port are then connected topriority logic 660 which provides outputs indicating which of the fiveframe filter outputs is the highest priority for each priority group.Thus the priority logic 660 effectively ORs each of the frame filteroutputs for each group. There may be more than one true output from thepriority logic 660, but only one true for each priority group. Thepriority grouping is preferably programmable.

The outputs of the priority logic 660 are provided to logic as shown inFIG. 10D which selects the filter action for the particular frame. Thefilter actions in the preferred embodiment are 1) forwarding, when theframe is to be transmitted, 2) discard, when the frame can be discardedand four processor actions, namely 3) LIST A, 4) LIST B, 5) FROZEN and6) LIST D. In the preferred embodiment there are filter selectionregisters corresponding to each of the frame actions, except LIST D.Each filter selection registers preferably contains 32 bits, onecorresponding to each frame filter output. The filter selection registeroutputs are ANDed with the prioritized frame filter outputs for eachframe action, as shown schematically in FIG. 10D with the outputs of theAND terms ORed together to produce a frame action signal. Thus, if anyframe filter bit is true and the corresponding filter selection registerbit is true, that frame action is selected. Preferably, the frame filterlogic does not check for multiple frame actions for a particular framefilter output, that correlation being made by the firmware 190. If noneof the frame actions are indicated by the AND/OR logic, a default actionof LIST D is taken. In a FROZEN case, the packet is frozen or held sothe firmware can fully analyze the packet to determine the properresponse. The FROZEN case is also used when it is necessary to check thevirtual frame filtering mechanism described below. LIST A, LIST B andLIST D frame actions are cases where processor intervention is required.The packet transmission is held until the switch processor can determinethe proper response.

These action outputs are provided to the transmitter logic 570 and tothe processor 202, depending on the action. The FORWARD and DISCARDaction outputs are provided directly to the transmitter logic 570, whichthen either forwards or discards the frame, as appropriate. The otheraction outputs are provided to the processor 202 and the transmitterlogic 570 essentially holds the frames until it receives an indicationfrom the processor 202 on the disposition of the frame. Thus, forwardedand discarded actions are handled at full wire speed, with the otheractions being potentially delayed because of processor handling times.This is not a performance issue in normal operation as the greatmajority of frames will be of the forward action, with only occasionalframes requiring processor support.

6. Type of Actions for Frame Filters

Reference is now made in more detail to the various types of actionsthat may be taken on a frame as a result of frame filtering inaccordance with the present invention. As discussed below, these typesof actions include forwarding the frame, discarding the frame, rejectinga frame, further processing via lists, default action, and freezing theframe in order to invoke virtual zone group processing.

One type of action comprises “forwarding” a frame, which is defined tomean transmitting a frame to its destination device.

Another type of action comprises “discarding” the frame. Morespecifically, Class 3 frames are discarded, while Class 2 frames aresent to the processor 202 if the frame filtering action is specified tobe discard/reject so that the appropriate Link Control response may begenerated. In general, the “discard” action can be carried out inseveral different ways. For example, in one embodiment, the original EOF(end of frame) for a frame to be discarded is replaced with a bad EOF.The recipient port is then notified to dump this frame immediately uponreceipt. In another embodiment, for example, the entire frame is readand dumped within the switch hardware 195, so as to avoid sending anybad frames.

Yet another type of action comprises actions specific to a particularport and categorized as List A and List B. Two separate lists arecreated for frames that are to be sent to the processor 202 for furtherhandling. Thus, List A and List B may refer to different actions fordifferent filter definition blocks. In general, List A and List Binvolve creating additional frame filters and forwarding frames to theprocessor 202 for further processing. For example, frames are forwardedto allow the processor 202 to modify the response to certain commands,or to further analyze various types of commands to determine if specialoperations need to be performed. Class 2 frames may also be sent to theprocessor 202 if the frame filtering action is specified as “discard” sothat the appropriate Link Control response may be generated. List A andB processing are described in more detail subsequently in the ListProcessing section.

Another type of action comprises “freezing” the frame being transmitted.When a frame is frozen, it is prevented from leaving the port, typicallyto allow additional virtual zone group information to be accessed. Aswill be described in further detail subsequently, the “frozen” action istaken where it is necessary to access the “virtual” memory structures inthe firmware. Virtual memory is used to store additional zone groupinformation if no room is available in the physical hardware structures.All frames destined for the port will not be transmitted while virtualmemory structures are accessed. The virtual memory is described in moredetail subsequently.

A further type of action comprises the “no match” or “default” action,which is triggered if none of the other actions are invoked. The“default” action is the back-up action to undertake on a frame if nofilter has matched. The frame should be forwarded to the embeddedprocessor 420 for further processing. Preferably the default action isdeveloped using the “List D” action.

7. Several Examples of Zoning with Frame Filtering

In accordance with the present invention, there are generally two typesof filter definition selections: static filters and dynamic filters.Static filters are arranged from the bottom up (i.e., low priority) anddynamic filters are arranged from the top down (i.e., high priority).Static filters are pre-assigned with fixed usage. There may be up to 4dynamic filters available for use. Filters not in use will be disabled,including unassigned filters, static filters that are not applicable,and dynamic filters not being used. In some cases, there may be no morefilter definition resources left for a dynamic filter to use. In suchcases, frames will be queued until resources become available to set upthe necessary dynamic filters.

When SCSI LUN-level zoning is selected, individual frame filters can becreated as a set of group-based logic terms ANDed together with certainfield selection terms. For example, these field select terms (“fields”)can include R_CTL, D_ID, S_ID, FC_TYPE, FCP_LUN, and FCP_CMD, as shownin FIG. 11B.

When extent zoning is selected, frame filters can be created to reviewboth the command and data frames for a desired extent. A first filter isdeveloped at the SID, DID, LUN level, with frames which match the SID,DID and LUN transmitted, but this filter is set at a lower priority. Asecond filter is developed using the zone group extent hit value incombination with a field definition block to capture, for example, aREAD command. If both bits are true, then this is a valid command frameto the extent and the frame is forwarded. One final filter would use thezone group SID, DID and LUN valid but no extent hit value in combinationwith the field definition block to capture, for example, a WRITEcommand. If both of these bits are true, then this is an extent miss andthe frame is discarded. This filter would be at a higher priority thanthe first filter to override the forwarding of the frame. It issatisfactory to discard only the command frame in the sequence, as theerror detection logic in either the host or storage device would rejector discard the following data frames because they would be to animproper or unregistered sequence. Operation in this manner simplifiesthe filtering logic for extent zoning as sequence tracking is notdesired. However, if discarding of each frame in the sequence isdesired, additional hardware to track the sequence and filters todiscard based on a LUN and sequence match could be added.

Examples of individual frame filters used to enable various zoninggroups may be stored in each filter definition selection register andare discussed as follows.

The Report LUN Data filter is a dynamic filter that enables LUN-levelzoning. More specifically, this filter is designed to trap Report LUNData/Response in order to allow the zoning kernel software to modify theframe information returned to the originator of the Report LUN Command.For example, a match of OX_ID, S_ID and D_ID identifiers can triggerthis filter at the Fx_Port. Those LUNs not qualified in the zone of theoriginator device will be removed from the Report LUN Data payload.After the Report LUN Data has been modified, it will be forwarded to theoriginator of the Report LUN Command.

The PLOGI Accept filter is a dynamic filter that enables WWN zoning.This filter is designed to trap a PLOGI Accept frame to allow the zoningkernel software to verify whether the WWN in the payload and WWN of thedestination device are in the same zone. Frames will be forwarded andappropriate zone groups will be set up if they are in the same zone. Forexample, the filter can be invoked when there is a match of OX_ID, S_IDand D_ID identifiers at the Fx_Port. If the frames are not in the samezone, frames will be marked with a bad status and the follow-up processwill be continued at each port driver per Fibre Channel specifications.The frame is discarded for class 3 type of frames and an appropriatelink control type of frame is sent out for class 2 type of frames.

The Report LUN Command filter is a static filter that can be implementedat the Fx_Port and E_Ports for enabling LUN-level zoning. The filter isdesigned to invoke a dynamic filter for trapping Report LUNData/Response. For example, the R_CTL, FC_TYPE, and FCP_CMND fields canbe checked to invoke a Report LUN Command. The Report LUN Command isforwarded once a dynamic filter has been set up. For example, thisfilter can be triggered when there is an S_ID, D_ID and zone group matchat the F_Port and FL_Port. When an E_Port is used with this filter, thedomain id of S_ID should be matched with the switch id so that no zonegroup match is needed. It is possible that there are no resources (FieldDefinition or Filter Definition) available for the dynamic filter setup. If no resources are currently available, the zoning firmware willwait until they are available. The Report LUN Command frame won't beforwarded until the dynamic filter set up is complete.

The PLOGI Request filter is a static filter that enables WWN zoning, andis designed to set up a dynamic filter to trap a PLOGI Accept frame ateither the Fx_Port or E_Port. The PLOGI Request will be forwarded oncethe dynamic filter has been set up. For example, this filter can betriggered with the R_CTL and FC_TYPE indicating an ELS, and a Commandcode indicating a PLOGI for the Fx_Port. When the E_Port is used, thedomain id of S_ID can be matched with the switch id. It is possible thatthere are no resources (Field Definition or Filter Definition) availablefor dynamic filter set up. If no resources are currently available, thezoning kernel software will wait until they are available. The PLOGIRequest frame will not be forwarded until the dynamic filter set up iscomplete. For Fx_Port, this filter allows the zoning software to verifywhether the WWN in the payload and WWN of the destination device are inthe same zone. Frames are forwarded and appropriate zone groups are setup if they are in the same zone. A PLOGI accept trap can also be set upif the source and destination devices between the logins are in the sameswitch. If they are not in the same zone, frames are marked with a “bad”status and the follow-up process is continued at each port driver perFibre Channel specifications. The frame is discarded for class 3 type offrames and the appropriate link control type of frame is sent out forclass 2 type of frames.

Virtual vs. Real Hardware for Filter Storage

Even if significant frame filtering resources are provided by the switchhardware, there may still be limitations with critical resources.Typical resources that may become space-limited include the DCAM, SCAM,zone group RAM and field definition control registers. The framefiltering system in accordance with the present invention will now bediscussed with focus on overcoming the “real” hardware limitationsthrough the concept of virtual DCAM, virtual SCAM and virtual zone groupRAM. It is noted that the embodiment for the quad-based frame filteringdiscussed below is purely illustrative, and that one of ordinary skillin the art will recognize that the concept of providing virtual capacityis well-suited to other embodiments of switches.

A. Frame Filtering with Virtual Hardware

DCAM, SCAM and zone group RAM are critical but may have limitedresources. For example, an embodiment in accordance with the presentinvention having 64 SCAM entries, 512 DCAM entries and 128 zone groupsshared across 4 ports of a half-chip, could pose significant limitationsfor potential frame filtering applications. In order to expand theresources of the half-chip hardware in this example, the concept ofvirtual DCAM, SCAM and zone group RAM is introduced to expand thephysical DCAM, SCAM and zone group RAM built-in “real” hardware.

Upon triggering the “frozen” filtering action previously discussed, thepresent invention provides a connection between the virtual hardware andthe real hardware. Generally, the virtual hardware should be larger thanthe real hardware. Since the capacity of the real hardware is less thanthe capacity of the virtual hardware, only a portion of the virtualentries should be loaded into the real hardware. When a filter “frozen”action is undertaken, the present invention will freeze the transmitport, interrupt the CPU and provide the frame with frozen status, so asto allow the firmware to process the virtual hardware information andclear up the frozen condition. In this example, the filter associatedwith the action (“frozen”) can be triggered upon a SCAM, DCAM or zonegroup miss. Once a frame is frozen and service is interrupted, theprocess will swap SCAM, DCAM and zone group entries between virtualhardware and real hardware. After new entries are loaded into the realhardware, frame filtering actions continue as normal until anotherfrozen action gets triggered.

The “frozen” filtering action provides a bridge for connections betweenthe virtual hardware and the real hardware. FIG. 17 illustrates theprocedure for processing a frozen filtering action. The frozen action istriggered when a DCAM, SCAM, or zone group miss occurs when virtualtranslation is enabled 1701. The switch hardware will be frozen 1710 andan interrupt will be generated 1720, thereby freezing the frame for aparticular port within the switch and interrupting the transmissionprocess. The frozen interrupt handler checks the Frozen Filtering Statusregisters 1730. The frozen interrupt handler then searches 1740 throughvirtual SCAM, DCAM and zone groups to determine 1750 if there is zonehit within the virtual structures. If there is no zone group hitassociated with the frozen frame, the filtering hardware is programmedto discard the frame 1752. In another embodiment, a different action maybe programmed if there is no zone group hit.

If there is a zone hit (based on the search result), virtual hardwareentries will be swapped into the real hardware 1760. The frame is thenre-transmitted 1770, allowing it to be properly processed by the newlyinstalled real hardware structures. If DCAM, SCAM or zone group entrieswere swapped and there are other ports (within the same quad) that arestill frozen, the other frames within these ports are alsore-transmitted 1780.

Thus, the capacities of the real DCAM, SCAM, zone group RAM and extentregisters can be expanded via the virtual hardware. In accordance withone embodiment of the present invention, the swapping of entries betweenvirtual hardware and real hardware is implemented within the driver atthe hardware level 195 without the need for an intermediate upper layersoftware (“midware”) 185 being involved. The midware 185 shouldrecognize that more zone groups can be configured.

The swapping of entries between virtual hardware and real hardware notonly increases the latency of frame delivery but also requiressignificant CPU bandwidth. Significant performance degradation ispossible if this swapping activity happens consistently. For example,consistent swapping activity could occur if concurrent traffic occursacross multiple zones, beyond the capacity of the real hardware. Thus,the desire for creating additional zone groups requiring virtual storageshould be balanced against the need for low-latency frame delivery.

This aspect of the present invention concerning virtual hardware isbeneficial in the situation where the resources of the field definitionblock 550 may become limited. For example, the field definition controlcapacity can be expanded with virtual hardware.

B. Mapping the Virtual Hardware to the Real Hardware

According to one embodiment of the present invention, the virtual SCAM,DCAM and zone group RAM: memory structures are implemented throughsystem memory at the firmware level 190. In this embodiment, all thezone group manipulations are exercised through the system memory firstbefore being actually applied to the real hardware. That is, memoryshould be updated before updating the hardware. One reason for doing sois to alleviate traffic on the PCI bus to the Fibre Channel circuits.

Typical manipulations of zone groups include: (1) add or remove a SCAMentry; (2) add or remove a DCAM entry; (3) add, remove, merge, or splitzone groups; and (4) remove or change extent registers. Once thesemanipulations are exercised in the system memory, the updated entriesare applied to the real hardware as needed. Not all of the changes inthe virtual hardware should be updated into the real hardware since thereal hardware typically has less capacity than the virtual hardware.Only those entries that are currently mapped into the real hardware needto be updated. A mapping operation enables entries from the virtualhardware to be applied to the real hardware, and to ensure that virtualentries are loaded into the proper real entries. This mapping operationis undertaken when swapping entries between the virtual hardware andreal hardware.

One manner of implementing the mapping operation is through virtualtranslation. Virtual translation can be enabled individually for SCAM510, DCAM 520, Subgroup A of the zone group RAMs 512, 522, Subgroup B ofthe zone group RAMs 512, 522, extent register 2000 and block start andend values or a combination of some or all of these structures. In thesituation where a large block of memory (e.g., approximately 1 MB) isreserved for virtual DCAM, SCAM and zone group RAM at initialization,the usage of this pre-allocated memory will be expanded as needed. Theexpanded usage may be needed for implementing virtual SCAM, DCAM, zonegroup RAM or a combination of some or all of them. Even if the number ofzone groups is the same across real Subgroup A and Subgroup B, whenaccess control is enabled, virtual Subgroup A and Subgroup B may bedifferent in size.

The aspect in accordance with the present invention pertaining tovirtual hardware is applicable even if the upper layer software does notneed additional virtual capacity other than what real hardware provides.In one embodiment in accordance with the present invention, the mappingbetween virtual hardware and real hardware can be simplified to aone-to-one correspondence in order to avoid carrying unnecessaryoverhead in situations where the additional virtual capacity isunnecessary. In another embodiment, the virtual SCAM and DCAM may beimplemented through additional real SCAM 510 and DCAM 522 instead ofthrough system memory, when both virtual and real SCAMs and DCAMs areexactly the same capacity. Both SCAMs and DCAMs can be mapped as systemmemory so as to trim the system overhead because there is no need toapply the virtual SCAM and DCAM to real SCAM 510 and DCAM 522.

C. An Implementation of Data Structures for Virtual Hardware

One embodiment of data structures that are well-suited for use withquad-based frame filter hardware management in accordance with thepresent invention will now be discussed. In the embodiment, reference ismade to a virtual zone group, a virtual SCAM, a virtual DCAM, a realzone group, a real SCAM and a real DCAM. It is noted that in thesituation where the management of virtual SCAM and virtual DCAM isalmost identical, it is preferable to use the same process to managedata structures corresponding thereto. Those of ordinary skill in theart will appreciate that in addition to the described embodiment, manyother different types of data structures may be used in the presentinvention, and that the data structures described herein are purelyillustrative.

In accordance with the present embodiment, a virtual zone groupcomprises data structures to enable the following functionality: avirtual zone group RAM, a virtual zone group dirty flag; a free virtualzone group pool, and a virtual zone group in use flag. The virtual zonegroup RAM memory is allocated for virtual zone group manipulation.Manipulations of the virtual zone group are performed on this RAM memoryfirst before being applied to the real zone group hardware show in FIG.5B. The dirty flag is associated with each virtual zone group entry asan indication of zone group “changed” status. For example, a dirty flagvalue of “1” can be defined to mean that the zone group has beenupdated. Virtual zone group entries marked changed may have to beapplied to the real zone group RAM. The dirty flag will be referencedwhen applying the virtual zone group to the real zone group for zonegroup updates. All virtual zone group entries not used can be kept in afree group pool. With each virtual zone group entry, another flag can beused to indicate if a particular virtual zone group is in use or not.

In order to implement the virtual SCAM, data structures can be designedto perform the following functions: virtual SCAM RAM; virtual SCAM dirtyflag; free virtual SCAM pool; virtual SCAM sorted indexed array; virtualSCAM aging list, and virtual SCAM in use flag. A virtual SCAM RAM isimplemented through system memory (i.e., central memory). Each virtualSCAM entry has a dirty flag associated with it as an indication of SCAM“changed” status. For example, a dirty flag value of “1” means thevirtual SCAM has been updated. Virtual SCAM entries marked changed mayhave to be applied to the real SCAM. Virtual SCAM entries not currentlyin use are kept in the free pool. An aging process is used to invalidateoutdated virtual SCAM entries, and can be implemented with a linkedlist. With each virtual SCAM entry, a flag can be used to indicate if aparticular virtual SCAM is in use or not. The virtual SCAM sorted indexarray data structure comprises an array of indexes, which point to SCAMentries. The order of these indexes is sorted by the content of the SCAMentry. The array is beneficial for speeding up the processing of afrozen interrupt at SCAM miss.

To implement a virtual DCAM, data structures can be used to perform thefollowing functions: virtual DCAM RAM; virtual DCAM dirty flag; freevirtual DCAM pool; virtual DCAM sorted indexed array; virtual DCAM aginglist; and virtual SCAM in use flag. A virtual DCAM RAM is implementedthrough system memory, similar to the virtual SCAM RAM. Each virtualDCAM entry has a dirty flag associated with it as an indication of DCAM“changed” status. For example, a dirty flag value of “1” means thevirtual DCAM has been updated. Virtual DCAM entries marked changed mayhave to be applied to the real DCAM. A virtual DCAM sorted index arraydata structure can, be implemented in a similar fashion to the virtualSCAM sorted index array so as to improve upon the processing time for afrozen interrupt when a DCAM miss occurs. In doing so, the datastructure comprises an array of indexes which are pointing to the DCAMentries. The order of the indexes may be sorted by content of DCAMentry. Virtual DCAM entries not currently in use are kept in the freepool, which may be implemented as a linked list. An aging process isused to invalidate outdated virtual DCAM entries, and can be implementedwith a linked list. With each virtual DCAM entry, a flag can be used toindicate if a particular virtual DCAM is in use or not.

The data structures for real zone group management are activated whenthe capacity of the virtual hardware is larger than the real hardware,thereby necessitating the swapping of virtual and real zone groupinformation. For example, real zone group entries not currently in useshould be kept in a free pool, which may be implemented as a linkedlist. Each real zone group entry contains an index to an associatedvirtual zone group. The index indicates which specific virtual zonegroup entry is currently holding the real zone group entry.

The data structures for real SCAM management are activated when thecapacity of the virtual hardware is larger than that of the realhardware. For example, data structures can be implemented for performingthe following functionality: free real SCAM pool; index to virtual SCAM;and retiring real SCAM list. In this example, the real SCAM entries notcurrently in use can be kept in a free pool. Each real SCAM entryincludes an index pointing to a virtual SCAM entry. The index indicateswhich specific virtual SCAM entry is currently holding this real SCAMentry. After implementing the frozen action upon a SCAM miss, a SCAMentry may be swapped out of a real SCAM entry to leave room for a newvirtual SCAM entry. Known round robin techniques can be implemented withhead and tail pointers for maintaining a list of the retiring real SCAMentries.

The data structures for real DCAM management should be activated whenthe capacity of the virtual hardware is bigger than that of the realhardware. The data structures for real DCAM management can beimplemented in a similar manner as discussed with the real SCAMmanagement.

D. Operations of Transport and Mapping Between the Virtual and RealHardware

In accordance with the described embodiment, several operations areperformed to facilitate the transport between the virtual hardware andthe real hardware. For example, one operation applies all virtualhardware (e.g., SCAM, DCAM and zone group entries) marked with the“dirty” indication to the real hardware. Another operation applies thespecific virtual SCAM, DCAM and zone group entries to the specific realSCAM, DCAM and zone group entries. In yet another operation, a specificvirtual SCAM entry is applied to a specific real SCAM entry, and allreal zone groups associated with the real SCAM are correspondinglyupdated in response thereto. This operation can be implemented similarlywith the virtual and real DCAMs. Additionally, a operation can beincluded to apply the specific zone group entry to a specific real zonegroup entry.

Other operations that can be implemented in accordance with the presentinvention include those operations which map the virtual to the realhardware. In general, two sets of mapping functions can be performed tomap between the virtual and the real hardware. A first set of mappingfunctions is referenced when the capacity of the virtual hardware is thesame as that of the real hardware. This first set of mapping operationsis relatively straightforward, since there is a one-to-one relationshipbetween the virtual hardware and the real hardware. Virtual translationis disabled with this case. A second set of mapping functions isreferenced when the capacity of the virtual hardware is larger than thatof the real hardware. This second set of mapping functions requiresadditional translation to map virtual hardware to the real hardware.Virtual translation is enabled with this case.

For example, the following mapping operations may be performed: mappingvirtual SCAM to real SCAM; mapping virtual DCAM to real DCAM; mappingvirtual zone group to real zone group; mapping real SCAM to virtualSCAM; mapping real DCAM to virtual DCAM; and mapping real zone group tovirtual zone group. For each of these mapping operations, there aregenerally two functions implemented, depending on whether virtualtranslation is enabled or not. When virtual translation is enabled, thevirtual hardware may not be loaded into the real hardware yet, and thusmapping will be failed given this condition. A new entry is madeavailable through allocation or retiring in order to map (i.e., load)new virtual hardware into real hardware.

Virtual entries are mapped to corresponding real entries in thefollowing manner. If virtual translation is not enabled, the index tothe virtual SCAM is the index to the real SCAM. If virtual translationis enabled, a search (sequential) for a SCAM entry must be accomplishedin order to locate the particular real SCAM; entry. Similarly, ifvirtual translation is not enabled, the index to the virtual DCAM is theindex to the real DCAM. If virtual translation is enabled, a search(sequential) for a DCAM entry must be accomplished in order to locatethe particular real DCAM entry. Additionally, if virtual translation isnot enabled, the index to the virtual zone group is the index to thereal zone group. If virtual translation is enabled, a search(sequential) for a zone group entry must be accomplished in order tolocate the particular real zone group entry.

By comparison, real entries are mapped to virtual entries in thefollowing manner. If virtual translation is enabled, a mapping operationwill be used to reference the real hardware entries to the virtualentries. The real SCAM is mapped to the virtual SCAM through referenceto the virtual SCAM index array. The real DCAM is mapped to the virtualDCAM through reference to the virtual DCAM index array. The real zonegroup is mapped to the virtual zone group through reference to thevirtual zone group index array.

E. Virtual Hardware Management

Virtual zone group management is split into Subgroup A and Subgroup B,whether or not access control is enabled. For ports with access controlenabled, the virtual zone groups used are allocated from the properSubgroup. For ports without access control, the zone groups can be usedfrom either Subgroup.

A variety of operations are performed on the virtual SCAM, DCAM and zonegroup structures. For example, the data structure of each of thesevirtual structures are initialized. Additionally, each of these virtualstructures can be allocated and returned to a free pool. For the virtualSCAM and DCAM, such entries can be inserted into a sorted index arrayfor referencing therefrom. Through a binary search, the virtual SCAM andDCAM entries may be located with the index array. The virtual SCAM andDCAM entries can also be added to a list for aging the entries, andlocated and removed as needed from the aging list. As discussedpreviously, a determination may be made whether two virtual zone groupentries can be merged through the same SCAM or DCAM entry. Likewise, theoperations for actually merging the two zone group entries based on theSCAM or DCAM entry are also provided. Furthermore, the operation ofmerging all virtual zone groups is provided, as is the operation ofadding a new virtual zone group and correspondingly arranging thevirtual resources to accommodate the added virtual zone group. Evenfurther, SCAM, DCAM and zone group entries may be: expanded when thevirtual hardware resources reach full capacity; removed; and split so asto preserve the integrity of the virtual resources. It will be evidentto one of ordinary skill in the art that a variety of other operationsmay be performed upon the virtual structures during the management offrame filtering operations.

F. Real Hardware Management

Real hardware management operations are referenced only when thecapacity of the virtual hardware is larger than that of the realhardware, e.g. virtual translation is enabled. Real zone groupmanagement is split into Subgroup A and Subgroup B, whether or notaccess control is enabled. For ports with access control enabled, realzone groups used are allocated from the proper Subgroup. For portswithout access control, zone groups can be used from either Subgroup.

A variety of operations are performed on the real SCAM, DCAM and zonegroup structures, similar to that described previously with regard tothe virtual structures. For example, the real SCAM, DCAM and zone groupstructures can be: initialized; and allocated from and returned to afree pool as needed. The same real structure entries may also locatedand retired. Also, each of the virtual SCAM, DCAM and zone group entriescan be located in the respective real SCAM, DCAM and zone grouphardware, if pre-existing. It will be evident to one of ordinary skillin the art that a variety of other operations may be performed upon thereal structures during the management of frame filtering operations.

Per Port Based Frame Filtering Hardware Management

Additional data structures and operations are provided in accordancewith the present invention to manage those dedicated field definitioncontrol and filter definition selection hardware of each port-basedlogic structure. For example, in the described embodiment of FIG. 5B,each port had 16 field definition registers, each of which defined oneoffset into a frame to be transmitted and several possible values (e.g.,four) for comparison operations. Each field definition register can bereferenced by one or more filter definition selection registers as aqualification for the triggering of a filter. Both field definition andfilter definition resources are critical and limited resources.

A. Field Definition Control and Resource Allocation

In the described embodiments, each of the field definition registersdefined can be referenced by one or more filter definition selections.With field definition registers, frame filters can be based on FC_TYPE,FCP_CMD, D_ID, S_ID, Exchange_ID and R_CTL fields.

It is noted that the FC_TYPE, FCP_CMD, and R_CTL fields are generallystatic fields. In order to trap PLOGI for WWN-level zoning and theReport LUN command for LUN-level zoning, the field definition registersshould be used to set up dynamic filters based on S_ID, D_ID and OX_ID.

B. Field Definition Control Management and Data Structures

The field definition control is a limited and shared resource, whichrequires management. Accordingly, for each field definition block 550,references from the filter definition blocks 540 are preferably tracked.In the described embodiments, there may be up to four values associatedwith each field, and all references to these values provided duringfilter definition selection can be tracked independently so thatresources may be freed at the value level. For example, an individualvalue can be freed even if its associated field definition is stillreferenced with other values. A word (e.g., four bytes) is allocated foreach field definition, and each byte represents a reference to a valueof a field definition block 550 from a filter definition block 540. Inthis example, a byte count of zero is defined to mean the associatedvalue is free for use. When the whole word (i.e., all four bytes) iszero, the associated field definition control is available for use.

When field and filter definition control becomes limited, requests forservice should be queued until resources are available. All framestrapped by the zoning driver and waiting for resources (i.e., fielddefinition control or filter definition selection) are kept in a queueuntil appropriate resources are available.

C. Field Definition Operations

In accordance with the present invention, there are a number of fielddefinition operations that are enabled. A first operation willinitialize the data structures required for the field definitioncontrol. Another operation will locate the field definition control andvalue position with specific offset and value. For example, thisoperation determines whether a specific offset, mask and value exist ina field definition control. The operation allocates the field definitioncontrol and associated value, if necessary. An index to the fielddefinition and position for a value can be returned for reference; andif either of these are unavailable, then a status indication should bereturned to queue the request for lack of resource space. It ispreferable that both resource be allocated, or none at all.

An operation in the nature of updating the field definition control witha specific value is provided, as is an operation to release the fielddefinition control being associated with a specific index and valueposition.

D. Filter Definition Selection and Usage Thereof

In one embodiment of the present invention, there are a predeterminednumber (e.g., 32) of filter definition selections (each representing anindividual frame filter combination of terms) available to each port.Generally, filter definition selections are indexed by number, forexample, with zero representing the highest priority filter and 31 thelowest priority filter. The application of filter definition for zoningis arranged carefully because the priority of each filter definitionselection can be relevant since, depending upon zone type setup for theport, selected filters may be setup for the port. For those filters notinstalled, they should be disabled. The application of each filter ispre-assigned at compile time, and these pre-assigned filters may bedisabled or enabled depending on zone type configuration.

Reference is now made to the following list of filter definitionselections. These individual frame filters include the following, whichhave been previously discussed: Report LUN Data; PLOGI Accept; ReportLUN Command, PLOGI Request. Further filter definition selectionsinclude: (1) DCAM, SCAM and zone group match; (2) Extended Link Serviceand Basic Link Service; (3) DCAM miss and SCAM match; (4) SCAM miss andDCAM match; (5) either DCAM or SCAM miss; (6) Zone group miss; (7)Discarding All Frames; (8) Forwarding All Frames; (9) AccessControl-Subgroup B with Write; and, (10) Access Control Subgroup B withany command.

A static filter which allows traffic in a zone can be triggered by aSCAM, DCAM and zone group match at the Fx_Ports. This filter ispreferably a default filter, designed to forward all frames with a zonegroup hit. The filter is preferably always installed if filtering isenabled through zoning.

Another static filter can be designed to capture all ELS (Extended LinkServices) and BLS (Basic Link Services) frames when a protocol wildcardis not enabled. The purpose of this filter is to allow the software tomake a decision regarding frame actions according to List A, and istriggered by TYPE (e.g., 0x00 or 0x01) as ELS or BLS on the Fx_Port.Without the protocol wildcard, a specific FC_TYPE is indicated with eachDCAM and SCAM entry. In order to save DCAM and SCAM resources, FC_TYPEfor ELS and BLS are not loaded into DCAM or SCAM entries. Thus, framefiltering will have a zone group miss for ELS and BLS frames due toFC_TYPE. ELS and BLS frames are forwarded or discarded through asoftware decision process. However, if the protocol wildcard is enabled,the ELS and BLS frames will be forwarded if they have a zone group hitby a higher priority filter, since no FC_TYPE will be checked. Forframes that have a zone group miss, one of the lower priority filtersshould discard them. It is preferable that this filter not be installedif the protocol wildcard is enabled, because with the protocol wildcardenabled, frames with a zone group miss should be discarded immediatelywithout software involvement.

Yet another static filter can be used to swap SCAM, DCAM and/or zonegroup entries as needed, so that virtual translation is enabled forDCAM, but not SCAM. This filter is triggered by a DCAM miss on theFx_Port. When the virtual DCAM is implemented, a frozen action results,so that DCAM, SCAM and zone group entries can be swapped between thevirtual hardware and the real hardware. Once appropriate entries havebeen swapped in, frames can be re-transmitted and qualified by filteringagain. Retransmitted frames should be processed by other filters withhigher priority, since there should be a SCAM, DCAM and zone group(either Subgroup A or Subgroup B) hit (e.g. the same frame should not behit with this filter again). Should a real DCAM, SCAM or zone group missoccur, the frames are discarded immediately without retransmission.

Conversely, another filter can be provided at the Fx_Port to swap DCAM,SCAM or zone group entries as needed when a SCAM miss and DCAM matchoccur. This static filter implements a virtual SCAM so that a frozenaction results, thereby enabling DCAM, SCAM and zone group entries to beswapped between the virtual hardware and the real hardware. Onceappropriate entries have been swapped in, frames are re-transmitted andqualified by filtering again. Re-transmitted frames are processed byother filters with higher priority, since there should be a SCAM, DCAMand zone group (either Subgroup A or Subgroup B) hit (e.g. the sameframe should not be hit with this filter again). Should a real DCAM,SCAM or zone group miss occur, the frames should be discardedimmediately without retransmission.

When there is either a DCAM or SCAM miss, a static filter can be enabledon the Fx_Port to swap SCAM, DCAM and zone group entries as needed. Thisfilter enables virtual translation for both SCAM and DCAM, so that afrozen action results, thereby allowing DCAM, SCAM and zone groupentries to be swapped between the virtual hardware and the realhardware. Once appropriate entries have been swapped in, frames arere-transmitted and qualified by filtering again. Re-transmitted framesshould be processed by other filters with higher priority, since thereshould be a SCAM, DCAM and zone group (either Subgroup A or Subgroup B)hit (e.g. the same frame should not be hit with this filter again).Should a real DCAM, SCAM or zone group miss occur, the frames should bediscarded immediately without re-transmission.

A static filter can be provided for a zone group miss from the Fx_Port,and can be designed to implement a virtual zone group, that is, eithervirtual Subgroup A or virtual Subgroup B. A frozen action results whenthere is a miss as to both Subgroup A and Subgroup B. This enablesvirtual translation, wherein DCAM, SCAM and zone group entries may beswapped between virtual hardware and real hardware. Once appropriateentries have been swapped in, frames will be re-transmitted andqualified by filtering again. The re-transmitted frames are processed byother filters with higher priority since there should be a SCAM, DCAMand zone group (either Subgroup A or Subgroup B) hit (e.g. the sameframe should not be hit with this filter again). Should a real DCAM,SCAM or zone group miss occur, the frames should be discardedimmediately without re-transmission.

A static filter can be provided for discarding all frames for whichthere is a zone group miss. This filter can be implemented on theFx_Port, and prevents traffic that is not within the same zone fromentering the zone. Preferably, this filter is enabled by default,thereby not requiring a conditional event to trigger the activation ofthe filter.

Another static filter can be provided for forwarding all frames throughan E_Port, unconditionally and preferably by default when zoning isenabled.

A further static filter can be provided at the Fx_Port to prevent writecommands for Subgroup B. This filter enables Access Control and discardsframes when there is a DCAM, SCAM and Subgroup B match, and when theR_CTL (with 0x06), FC_TYPE (with 0x08), FCP_CMD (with either 0x2A or0x0A) fields indicate a write.

Also, a static filter can be provided at the Fx_Port to investigate thenature of the command received. Access Control is enabled when there isa DCAM, SCAM and Subgroup B match, and when the R_CTL (with 0x06),FC_TYPE (with 0x08) fields indicate any FCP Command except Read. Forexample, a Mode Sense command is considered to be a write command innature and is discarded. By contrast, a Mode Select command isconsidered to be a read command in nature and is forwarded. This filterproduces an action corresponding to List A.

E. Data Structures for Zoning Filters

Certain data structures are created for the management of the zoningfilters. A filter status array can identify the status of each filter tosignify whether it is enabled or disabled. Zoning filters are alsoshadowed in the system memory. In one embodiment, each filter is 32bytes and there are 32 filters per port, requiring approximately 1kilobyte of memory to shadow all the filters for a port. Filtershadowing is designed to speed up access to filter definition selectionsince the manipulation can be done in the kernel software and the writeto the hardware can be done in at least 32-bit accesses, as opposed tohardware manipulation which may be implemented on a bit basis. Filtershadowing is also used to verify the filter definition selectionintegrity.

A variety of operations can be performed on the zoning filters. Filtersare initialized, which typically disables the static filters and freesthe dynamic filters. Dynamic filters may be allocated and freed asrequired. Additionally, both dynamic and static filters may be enabledand disabled. It will be evident to one of skill in the art that avariety of other operations may be performed upon the zoning filtersduring the management of frame filtering operations.

As discussed previously, DCAM, SCAM, zone group, field definitioncontrol and filter definition selection are critical and limitedresources in the described embodiments. These frame filteringstructures, both virtual and real, have a direct impact on theavailability of zoning features. Occasionally, some of the informationcontained in these frame filtering structures becomes outdated. Forexample, devices attached to a switch may go offline. Invalid DCAM, SCAMand zone group entries may accumulate, eventually draining framefiltering resources and causing zoning to fail. Additionally, invalidentries may confuse the zoning logic. A similar situation may occur withthe field definition control and filter definition selection resourcesused to implement dynamic filters. The exchange to be trapped may nevershow up, and these frame filtering resources are drained.

In one embodiment, in order to address these issues, an aging mechanismdesigned to invalidate entries and reclaim frame filtering resources isapplied to some or all of the frame filtering resources. An agingcounter is updated and checked periodically for SCAM, DCAM, and zonegroup resources. When a pre-selected aging count is reached, SCAM andDCAM entries are removed from both the real and virtual DCAM and SCAM. ADCAM entry removal may require SCAM entries and zone groups to beremoved and/or reorganized. Likewise, a SCAM entry removal may requireDCAM entries and zone groups to change. The aging counters are triggeredby a port or device going offline and the counters can be incremented ona per second basis. The duration of the counters may be set to expireaccording to the Fibre Channel specific timeout values (e.g., 5 secondsfor the firmware).

For field definition control and filter definition selection resources,aging is triggered by the installation of dynamic filters. Each dynamicfilter has its own aging counter. When a pre-selected aging count isreached, the field definition control and filter definition selectionresources are released for reuse. Aging counters are deactivatedwhenever a dynamic filter traps a frame.

Software and Hardware Initialization

The data structures described above are first initialized before theyare used in frame filtering management. First, filtering kernel softwareis initialized at the quad level, before the hardware is ready to beinitialized.

For example, the number of real SCAM, DCAM, and zone group entries isfirst determined. Virtual SCAM management is initialized, which in turninitializes the data structures used in virtual SCAM management. VirtualDCAM management is initialized, which in turn initializes the datastructures used in virtual DCAM management. Since the management ofvirtual SCAM and virtual DCAM is similar, the same routine may be usedto manage both data structures. The virtual zone group management isinitialized, which will initialize the data structures used in virtualzone group management. Next, real SCAM management is initialized, andreal DCAM management is initialized. This initializes the relative datastructures for the real SCAM and DCAM. The same routine may also be usedto manage both real SCAM and real DCAM data structures. Lastly, the realzone group management is initialized.

Once the frame filtering quad-based management structures have beeninitialized, the quad-based filtering hardware is initialized. The SCAMhardware is initialized, then the DCAM hardware is initialized, and thenthe zone group hardware is initialized. Next the port-based software andhardware structures are initialized. Data structures for filterdefinitions are initialized, and also for the field definitions. Allother port-based hardware and software is then initialized.

Midware Programming of Firmware

Once the kernel software (at firmware 190) and hardware 195 used inframe filtering have been initialized, the midware 185 uses the zoningconfigurations input by the user (at interface 180) to program thefirmware 190 for the requested frame filtering capabilities. The midware185 issues various Input/Output control (IOCTL) calls to the firmware190, several of which are described herein. It will be evident to one ofordinary skill in the art that many additional types of IOCTL calls arepossible. The examples provided herein are purely for illustrativepurposes.

A. Adding a Specified Zone Configuration to a Port

FIG. 12 illustrates one embodiment of a process by which a specifiedzone configuration is added to a port. In general, the operation to adda zone type can be used to enable WWN-level and port-level zoning, andalso to enable LUN-level zoning, protocol-level zoning and accesscontrol level zoning, if desired. The midware 185 first checks to ensurethat the operation to add the zone type is valid 1210. In response, thefirmware 190 checks for conflicts between programmed zone configurationsand also checks to see if zoning resources, such as filter definitionblocks 540, are running out of capacity. A zoning conflict exists if theconfiguration's device nomenclature is inconsistent, such as if some butnot all members of a zone are specified with device level zoning. Also,zones that do not accept FCP traffic cannot be created if any LUN-levelzoning is specified. If a conflict exists or zoning resources are full,an error is returned 1212.

If the operation to add a zone type is valid, then default filters areinstalled 1220. For example, the default filters are the static filtersthat have been pre-assigned to the frame filtering system. Thesedifferent types of default filters include port-level zoning andWWN-level zoning filters. Next, the firmware checks to see if accesscontrol has been enabled 1230. If access control has been enabled, theaccess control filters are installed 1232. The firmware 190 thencontinues to check if the zone type is WWN-level zoning 1240. If thezone type is WWN-level zoning, a trap PLOGI filter is installed 1242 inorder to capture and be made aware of where the WWN device connects tothe fabric.

The firmware 190 then continues to check if LUN-level zoning has beenenabled 1250. If LUN-level zoning is enabled, a Report LUN trap filteris installed 1252 in order to capture and modify, if necessary, theReport LUN command. LUN-level zoning structures can be used to filterframes based on frame content other than a LUN value if the specifiedframe offset is set to point to something other than LUN number. Whenthe frame offset is not set for LUN level zoning, a Report LUN commandtrap filter is not set up. The firmware 190 then proceeds to program theLUN offset register 1260. Typically, the LUN offset register includes upto four different offsets and masks to identify the LUN number, as wellas the FC_TYPE that must be found before the LUN number field will besearched. The LUN offset register may be left blank if no LUN levelzoning or other specified frame offset information is desired. Thefirmware 190 then continues to check if extent zoning is enabled for theparticular LUN 1262. If so, the firmware 190 programs the various extentregisters as appropriate 1264.

B. Adding a Destination ID to a Zone Group

FIGS. 13A and 13B illustrate the process by which a D_ID with up to 64S_IDs is grouped into one zone group. There may be up to 4 FC_TYPEvalues, and up to 4 offsets within the first 64 bytes of the frameheader, usually the LUN number offsets, are included as part of the zonegroup specification. This operation to add a zone effectively adds asingle D_ID based zone group to a port. At step 1310, a request isreceived to add a zone. In response thereto, the firmware 190 checks tosee if there is available virtual zone group resources 1312. If there isno more virtual zone group space available, the firmware 190 returns anerror 1314. If resources are available, a virtual zone group entry isallocated from the virtual zone group free pool 1316.

The firmware 190 then determines 1320 whether the requested zone groupadds a new virtual DCAM entry or if the virtual DCAM entry alreadyexists. If the virtual DCAM entry already exists, the firmware 190checks 1326 that the virtual DCAM entry has been located. If the virtualDCAM entry cannot be located, the virtual zone group and associated DCAMand SCAM entries are returned to their free pools 1328. If a new DCAMentry is to be added, the firmware 190 determines 1322 whether there isfree virtual DCAM available. If no free virtual DCAM is available, thenew virtual zone group and all associated virtual DCAM entries arereturned to their free pools 1328, and the request fails and returns anerror. If a free virtual DCAM is available, a virtual DCAM entry isallocated from the virtual DCAM free pool 1324. The new virtual DCAMentry is marked “dirty” 1330, and the new DCAM entry is loaded into thevirtual DCAM 1332.

After the existing DCAM entry is located 1326 or the new DCAM entry hasbeen loaded 1332, the zone group bit and extent register entriesassociated with the DCAM entry are marked 1340. The firmware 190 thendetermines 1342 whether an additional FC_TYPE has been specified withthe requested zone group. If an additional FC_TYPE has been specified,the operation returns to step 1320 to check if the next additional DCAMentry is new. If an additional FC_TYPE has not been specified, thefirmware 190 checks 1350 to determine if the requested zone group adds anew virtual SCAM entry or if the virtual SCAM entry already exists. Ifthe virtual SCAM entry already exists, the firmware 190 checks 1352 thatthe virtual SCAM entry has been located. If the virtual SCAM entrycannot be located, the virtual zone group and associated SCAM and DCAMentries are returned to their free pools 1328.

If a new SCAM entry is to be added, the firmware 190 determines whetherthere is free virtual SCAM available 1354. If no free virtual SCAM isavailable, the new virtual zone group and all associated virtual SCAMand DCAM entries are returned to their free pools 1328, and the requestfails with an error being returned. If a free virtual SCAM is available,a virtual SCAM entry is allocated from the virtual SCAM free pool 1356.The new virtual SCAM entry is marked “dirty” 1360, and the new SCAMentry is loaded into the virtual SCAM 1362.

After the existing SCAM entry is located 1352 or the new SCAM entry hasbeen loaded 1362, the zone group bit and extent register entriesassociated with the SCAM entry are marked 1370. The firmware 190 thenchecks 1372 to see if an additional FC_TYPE has been specified with therequested zone group. If an additional FC_TYPE has been specified, theoperation returns to step 1350 to check if the next additional SCAMentry is new. After all FC_TYPEs have been incorporated, the new virtualzone group and extent register entries are merged 1380 with existingvirtual zone groups. Merging is repeated until no more merging ispossible. All zone groups that have been modified are marked as dirty1382. All virtual SCAM, DCAM zone group, and extent registers entriesmarked dirty are applied to the real SCAM, DCAM, zone groups, and extentregisters accordingly.

Once the operation to add a zone type has set up the frame filters for aparticular zone type at a port, and a series of operations for adding azone have installed a series of D_ID based zone groups to a specifiedport, the operation for enabling a zone is used to enable the zoningconfiguration in the hardware 195. By doing so, all frame trafficthrough the port will be subject to frame filtering.

C. Enabling Zoning for a Specified Port

FIG. 14 illustrates the process by which zoning is enabled in a port ofa switch. The purpose of this operation is to enable zoning for allports of a switch except those ports that have been excluded.

The firmware 190 checks to ensure that the port of interest is present1410. If the port is not present, an error is returned 1412. Next thefirmware 190 checks to ensure that the port filters have been installed1420. If the port filters have not yet been installed, an error isreturned 1422. The firmware then proceeds to program the hardware withthe installed port filters 1430. It will be understood by one of skillin the art that the process to enable zoning may proceed port-by-portthrough the ports of the switch, or may be performed substantially inparallel through the ports of the switch.

D. Resetting Zone Configuration for a Port

FIG. 15 illustrates the process by which zoning is removed in a port ofa switch. This operation to reset a zone will wipe out both zone typeand all zone groups configured for all ports of the switch. Theoperation can be invoked over any port of a particular switch and allports of the switch will be affected. Whenever there is a zoning change,this operation is used to clear all zone configurations so that thezoning software can start building a new zoning configuration.

As shown in FIG. 15, the firmware 190 checks the port number for theport currently of interest 1510. For example, if the port number is 0,4, 8, 12, then all of the quad-based SCAM, DCAM and zone groupmanagement is deleted 1512. The quad-based management features only needto be deleted once per each set of four ports, which is accomplished byonly deleting them for every fourth port. Next, the per-port basedzoning information is cleared 1520. All associated resources are freed1530. Then zoning is disabled 1542. It will be understood by one ofskill in the art that the process to reset the zone may proceedport-by-port through the ports of the switch, or may be performedsubstantially in parallel through the ports of the switch.

List Processing

Certain types of frame filters designate either “List A” or “List B” asthe action to take if their frame filter criteria are satisfied. In oneembodiment, List A is dedicated for dynamic filters, and List B isdedicated for static filters. List processing is typically carried outby the firmware 190 residing on the CPU of the switch.

Referring to FIG. 16, list processing begins when a frame filteringaction prioritization process returns a “list” action 1601. The framebeing filtered is then placed into either List A or List B forprocessing 1610. If the received frame is in List A, the process checksif the frame is a PLOGI Accept frame 1612. A PLOGI Accept frame is usedby devices to log into the fabric, and provides information about whereparticular WWN devices are actually connected. A zone check request isissued 1620 to the midware 185 upon the information contained in thePLOGI Accept frame to check for potential zone conflicts caused by thenew device. The dynamic filter set up to trap the particular PLOGIAccept frame is then freed 1622, and the process ends 1624.

If the frame is not a PLOGI Accept frame, the process checks if theframe is a Report LUN Data/Response frame 1614. A Report LUNData/Response frame informs devices of which LUNs are available forcommunication. The Report LUN Data/Response frame payload is modified1630 by the CPU, in order to remove LUNs and/or extents not in the zoneof the destination device. In this way, the destination device will notlearn about the existence of LUNs outside of its particular, zone. Thedynamic filter set up to trap the particular Report LUN Data/Responseframe is then freed 1632, the modified Report LUN Data/Response frame isforwarded 1634, and the process ends 1636.

In one embodiment, if the frame in List A is not a PLOGI Accept or aReport LUN Data/Response frame, the processing ends 1616. It will beevident to one of skill in the art that additional actionable types offrames may be added to List A.

If the received frame is in List B, the process checks to determine ifthe frame is a PLOGI frame 1652. Based upon the PLOGI frame, a dynamicfilter is set up 1660 to trap the associated PLOGI Accept frame, and thezone check is issued 1662 to the midware to ensure that the PLOGI isperformed between the devices that are within the same WWW zone. Theprocess then ends at 1664.

If the frame is not a PLOGI Command frame, the process checks if theframe is a Report LUN Command frame 1654 (i.e., which is an FCP commandframe with CSI cdb 0 being 0xA0). Based upon the Report LUN Commandframe, a dynamic filter is set up 1670 to trap the associated Report LUNData/Response frame, and the Report LUN Command frame is forwarded 1672.The process then ends 1674.

In one embodiment, if the frame in List B is not a PLOGI Command or aReport LUN Command frame, the processing ends 1690. It will be evidentto one of skill in the art that additional actionable types of framesmay be added to List B.

Thus has been described a method and apparatus according to the presentinvention to do both frame filtering and hardware zoning at full wirespeed. Frame filtering can be very flexible and hardware zoning can bedone on many different conditions, greatly improving the security of thefabric while maintaining performance levels. Additionally, flexibilityhas been shown by the ability to virtualize the limited hardware, toallow even more selection by the administrator with only a small loss insystem performance.

Although the invention has been described in considerable detail withreference to certain embodiments, other embodiments are possible. Aswill be understood by those of skill in the art, the invention may beembodied in other specific forms without departing from the essentialcharacteristics thereof For example, different numbers of ports (otherthan the four ports illustrated herein) may be supported by the zonegroup based filtering logic. Additionally, the hardware structureswithin the switch may be modified to allow additional frame payloadbytes to be read and used for frame filtering. Accordingly, the presentinvention is intended to embrace all such alternatives, modificationsand variations as fall within the spirit and scope of the appendedclaims and equivalents.

1. A Fibre Channel device for use in a Fibre Channel fabric, the fabriccoupling a plurality of external devices, the fabric configured into atleast two zones, where the external devices are allowed to exchange datapackets only with external devices in the same zone, the Fibre Channeldevice enforcing the zones in hardware, the Fibre Channel devicecomprising: a receiving port for coupling to the fabric and receivingdata packets; a transmitting port for coupling to the fabric andtransmitting data packets; and device logic connecting said receivingport and said transmitting port, wherein said device logic includes:zoning data storage for storing configuration data indicative of thezone configuration of the fabric, including logical unit numbers (LUNs)and extents within such LUNs of the external devices allowed to exchangedata packets; a LUN and block fields comparison circuit connected tosaid zoning data storage for comparing the LUN and block fields of areceived data packet with said stored configuration data and providingan output; and an action circuit connected to said LUN and block fieldscomparison circuit and utilizing said LUN and block fields comparisoncircuit output to determine an action to be performed on the receiveddata packet.
 2. The Fibre Channel device of claim 1, wherein the actiondetermined by said action circuit is to forward the data packet, andwherein said transmitting port transmits the data packet.
 3. The FibreChannel device of claim 1, wherein the action determined by said actioncircuit is to discard the data packet, and wherein said transmittingport does not transmit the data packet.
 4. The Fibre Channel device ofclaim 1, wherein said device logic further includes: a central memoryfor storing data packets; receiver logic connected to said receivingport and said central memory for receiving a data packet from saidreceiving port and storing the data packet in said central memory; andtransmitter logic connected to said transmitting port and said centralmemory for retrieving the data packet from said central memory andproviding the data packet to said transmitting port, wherein said zoningdata storage, said LUN and block fields comparison circuit and saidaction circuit are included in said transmitter logic.
 5. The FibreChannel device of claim 1, wherein the external devices arefabric-attached, loop-attached or a combination of fabric-attached andloop-attached.
 6. The Fibre Channel device of claim 1, wherein theexternal devices are fabric-attached.
 7. The Fibre Channel device ofclaim 1, wherein said device logic further includes: a Fibre Channeltype comparison circuit connected to said zoning data storage and saidaction circuit for comparing the Fibre Channel type of a received datapacket with said stored configuration data and providing an output; andwherein said action circuit further utilizes said Fibre Channel typecomparison circuit output to determine said action to be performed. 8.The Fibre Channel device of claim 7, wherein said zoning data storagefurther includes: addresses of the external devices allowed to exchangedata packets; wherein said device logic further includes: a sourceaddress comparison circuit connected to said zoning data storage forcomparing the source address of a received data packet with said storedconfiguration data and providing an output; and a destination addresscomparison circuit connected to said zoning data storage for comparingthe destination address of a received data packet with said storedconfiguration data and providing an output; and wherein said actioncircuit further utilizes said source address and destination addresscomparison circuit outputs to determine said action to be performed. 9.The Fibre Channel device of claim 8, wherein said zoning data storagefurther includes an offset value defining an amount of offset into adata packet to indicate the location of the LUN field in the datapacket, and wherein said LUN and block fields comparison circuitutilizes said offset value to determine the LUN field of the receiveddata packet.
 10. The Fibre Channel device of claim 7, wherein saidzoning data storage further includes an offset value defining an amountof offset into a data packet to indicate the location of the LUN fieldin the data packet, and wherein said LUN and block fields comparisoncircuit utilizes said offset value to determine the LUN field of thereceived data packet.
 11. The Fibre Channel device of claim 1, whereinsaid zoning data storage further includes an offset value defining anamount of offset into a data packet to indicate the location of the LUNfield in the data packet, and wherein said LUN and block fieldscomparison circuit utilizes said offset value to determine the LUN fieldof the received data packet.
 12. A Fibre Channel switch for use in aFibre Channel fabric, the fabric coupling a plurality of externaldevices, the fabric configured into at least two zones, where theexternal devices are allowed to exchange data packets only with externaldevices in the same zone, the Fibre Channel switch enforcing the zonesin hardware, the Fibre Channel switch comprising: a microprocessor;local memory connected to said microprocessor; and a Fibre Channeldevice connected to and controlled by said microprocessor, wherein saidFibre Channel device includes: a receiving port for coupling to thefabric and receiving data packets; a transmitting port for coupling tothe fabric and transmitting data packets; and device logic connectingsaid receiving port and said transmitting port, wherein said devicelogic includes: zoning data storage for storing configuration dataindicative of the zone configuration of the fabric, including logicalunit numbers (LUNs) and extents within such LUNs of the external devicesallowed to exchange data packets; a LUN and block fields comparisoncircuit connected to said zoning data storage for comparing the LUN andblock fields of a received data packet with said stored configurationdata and providing an output; and an action circuit connected to saidLUN and block fields comparison circuit and utilizing said LUN and blockfields comparison circuit output to determine an action to be performedon the received data packet.
 13. The Fibre Channel switch of claim 12,wherein the action determined by said action circuit is to forward thedata packet, and wherein said transmitting port transmits the datapacket.
 14. The Fibre Channel switch of claim 12, wherein the actiondetermined by said action circuit is to discard the data packet, andwherein said transmitting port does not transmit the data packet. 15.The Fibre Channel switch of claim 12, wherein said device logic furtherincludes: a central memory for storing data packets; receiver logicconnected to said receiving port and said central memory for receiving adata packet from said receiving port and storing the data packet in saidcentral memory; and transmitter logic connected to said transmittingport and said central memory for retrieving the data packet from saidcentral memory and providing the data packet to said transmitting port,wherein said zoning data storage, said LUN and block fields comparisoncircuit and said action circuit are included in said transmitter logic.16. The Fibre Channel switch of claim 12, wherein the external devicesare fabric-attached, loop-attached or a combination of fabric-attachedand loop-attached.
 17. The Fibre Channel switch of claim 12, wherein theexternal devices are fabric-attached.
 18. The Fibre Channel switch ofclaim 12, wherein said device logic further includes: a Fibre Channeltype comparison circuit connected to said zoning data storage and saidaction circuit for comparing the Fibre Channel type of a received datapacket with said stored configuration data and providing an output; andwherein said action circuit further utilizes said Fibre Channel typecomparison circuit output to determine said action to be performed. 19.The Fibre Channel switch of claim 18, wherein said zoning data storagefurther includes: addresses of the external devices allowed to exchangedata packets; wherein said device logic further includes: a sourceaddress comparison circuit connected to said zoning data storage forcomparing the source address of a received data packet with said storedconfiguration data and providing an output; and a destination addresscomparison circuit connected to said zoning data storage for comparingthe destination address of a received data packet with said storedconfiguration data and providing an output; and wherein said actioncircuit further utilizes said source address and destination addresscomparison circuit outputs to determine said action to be performed. 20.The Fibre Channel switch of claim 19, wherein said zoning data storagefurther includes an offset value defining an amount of offset into adata packet to indicate the location of the LUN field in the datapacket, and wherein said LUN and block fields comparison circuitutilizes said offset value to determine the LUN field of the receiveddata packet.
 21. The Fibre Channel switch of claim 18, wherein saidzoning data storage further includes an offset value defining an amountof offset into a data packet to indicate the location of the LUN fieldin the data packet, and wherein said LUN and block fields comparisoncircuit utilizes said offset value to determine the LUN field of thereceived data packet.
 22. The Fibre Channel switch of claim 12, whereinsaid zoning data storage further includes an offset value defining anamount of offset into a data packet to indicate the location of the LUNfield in the data packet, and wherein said LUN and block fieldscomparison circuit utilizes said offset value to determine the LUN fieldof the received data packet.
 23. A Fibre Channel fabric comprising: aplurality of external devices; a first Fibre Channel switch coupled to afirst portion of said plurality of external devices; and a second FibreChannel switch coupled to a second portion of said plurality of externaldevices and coupled to said first Fibre Channel switch, wherein thefabric is configured into at least two zones, where said externaldevices are allowed to exchange data packets only with external devicesin the same zone and wherein said first and second Fibre Channelswitches enforce the zones in hardware, each of said first and secondFibre Channel switches including: a microprocessor; local memoryconnected to said microprocessor; and a Fibre Channel device connectedto and controlled by said microprocessor, wherein said Fibre Channeldevice includes: a receiving port for coupling to the fabric andreceiving data packets; a transmitting port for coupling to the fabricand transmitting data packets; and device logic connecting saidreceiving port and said transmitting port, wherein said device logicincludes: zoning data storage for storing configuration data indicativeof the zone configuration of the fabric, including logical unit numbers(LUNs) and extents within such LUNs of the external devices allowed toexchange data packets; a LUN and block fields comparison circuitconnected to said zoning data storage for comparing the LUN and blockfields of a received data packet with said stored configuration data andproviding an output; and an action circuit connected to said LUN andblock fields comparison circuit and utilizing said LUN and block fieldscomparison circuit output to determine an action to be performed on thereceived data packet.
 24. The Fibre Channel fabric of claim 23, whereinthe action determined by said action circuit is to forward the datapacket, and wherein said transmitting port transmits the data packet.25. The Fibre Channel fabric of claim 23, wherein the action determinedby said action circuit is to discard the data packet, and wherein saidtransmitting port does not transmit the data packet.
 26. The FibreChannel fabric of claim 23, wherein said device logic further includes:a central memory for storing data packets; receiver logic connected tosaid receiving port and said central memory for receiving a data packetfrom said receiving port and storing the data packet in said centralmemory; and transmitter logic connected to said transmitting port andsaid central memory for retrieving the data packet from said centralmemory and providing the data packet to said transmitting port, whereinsaid zoning data storage, said LUN and block fields comparison circuitand said action circuit are included in said transmitter logic.
 27. TheFibre Channel fabric of claim 23, wherein said external devices arefabric-attached, loop-attached or a combination of fabric-attached andloop-attached.
 28. The Fibre Channel fabric of claim 23, wherein saidexternal devices are fabric-attached.
 29. The Fibre Channel fabric ofclaim 23, wherein said device logic further includes: a Fibre Channeltype comparison circuit connected to said zoning data storage and saidaction circuit for comparing the Fibre Channel type of a received datapacket with said stored configuration data and providing an output; andwherein said action circuit further utilizes said Fibre Channel typecomparison circuit output to determine said action to be performed. 30.The Fibre Channel device of claim 29, wherein said zoning data storagefurther includes: addresses of the external devices allowed to exchangedata packets; wherein said device logic further includes: a sourceaddress comparison circuit connected to said zoning data storage forcomparing the source address of a received data packet with said storedconfiguration data and providing an output; and a destination addresscomparison circuit connected to said zoning data storage for comparingthe destination address of a received data packet with said storedconfiguration data and providing an output; and wherein said actioncircuit further utilizes said source address and destination addresscomparison circuit outputs to determine said action to be performed. 31.The Fibre Channel device of claim 30, wherein said zoning data storagefurther includes an offset value defining an amount of offset into adata packet to indicate the location of the LUN field in the datapacket, and wherein said LUN and block fields comparison circuitutilizes said offset value to determine the LUN field of the receiveddata packet.
 32. The Fibre Channel device of claim 29, wherein saidzoning data storage further includes an offset value defining an amountof offset into a data packet to indicate the location of the LUN fieldin the data packet, and wherein said LUN and block fields comparisoncircuit utilizes said offset value to determine the LUN field of thereceived data packet.
 33. The Fibre Channel device of claim 23, whereinsaid zoning data storage further includes an offset value defining anamount of offset into a data packet to indicate the location of the LUNfield in the data packet, and wherein said LUN and block fieldscomparison circuit utilizes said offset value to determine the LUN fieldof the received data packet.